Last updated April 29, 2026.
Account takeover has skyrocketed in the past year, particularly with the advent of AI-powered cyber attacks. Many organizations simply lack the tools to monitor unusual account behavior with cloud services. Below is a list of signs your Microsoft 365 account may be hacked.
Key takeaways:
💡 Need help with M365 Security?
If you notice suspicious activity like missing or deleted emails, your account may be compromised. Hackers will often attempt to cover their tracks once they have access to your account. Purging emails that may tip you off to their presence is a common sign of being hacked.
Other users may receive and respond to emails from you without the email existing in your Sent Items Folder. Once a hacker accesses your account, they are in a race to steal as much money and information as quickly as possible.
If you notice forwarding rules that you didn’t set up, it may be a hacker. They often set up rules to forward your emails to their accounts to hide emails in infrequently used folders such as the Notes, Junk Email, or RSS Subscription Folders.
If your account has been used to send a large volume of spam, Microsoft can prohibit you from sending emails. If you are connected to your account and unable to send emails, you may have been hacked.
If you see odd emails such as “I’m stuck in Paris, send money!” or other emails you didn’t send in either of these folders, a hacker may have sent them. Emailing your friends and asking for money is a common ploy used.
If your profile name, address, or phone number has been changed, it may be a hacker impersonating you. They may attempt to redirect calls or mail by updating your profile to include erroneous information to extend the fraud beyond email.
If you find yourself suddenly locked out of your account, you need to immediately contact your system administrator. While users frequently lock themselves out of their account, if you know you did not, you should immediately be suspicious.
If you start receiving emails or calls from friends and business contacts regarding suspicious emails from your account, you need to take action immediately. The longer the account is in the hands of the hacker, the greater the damage to you and your organization’s reputation.
Outlook shows new email subject links in bold for unread emails. If you notice a new email that you haven’t read is not in bold, you should be suspicious.
If you believe you should have received an email but have not, first make sure you are connected to Microsoft Exchange. If you are connected and still have not received emails for a considerable amount of time, you should be suspicious. Hackers often setup mailbox rules to deliver inbound emails to the deleted items folder, delaying your ability in determining that your account has been taken over.
Contact us today to get the outside perspective you need for the next step on your journey.
💡 Need help with M365 Security?
We’ll respond within 1 business day, or you can grab time on our calendar.
