Microsoft 365 account hacked? What to do in the first hour
Microsoft 365 account hacked or clicked a phishing link? The first-hour checklist, the hidden inbox rules to check, and who to tell in Australia.
If your Microsoft 365 account has been hacked, or you typed your password into a phishing page, work in this order. If money has moved, ring your bank first. Then, from a clean device, block sign-in, reset the password, sign out every session, remove MFA methods and app consents the attacker added, and delete their forwarding and inbox rules. Finally, work out who to tell.
How do you know a Microsoft 365 account has been compromised?
Microsoft's guide to responding to a compromised email account (checked October 2026) lists these warning signs, and the checklist below follows its steps. Any one sign is enough to start.
Inbox rules nobody remembers creating, especially ones that forward mail to unknown addresses or move it into the Notes, Junk Email or RSS Subscriptions folders.
New external forwarding on the mailbox.
Strange messages in Sent Items or Deleted Items, such as an urgent money request the owner never wrote.
Missing email, or a mailbox suddenly blocked from sending.
Unexplained password changes or lockouts.
Watch for two human signs too: an MFA prompt nobody started, and a client asking about an email you never sent.
Clicked a link but typed nothing? Do this
A click alone is less serious than a typed password, but always report it:
Close the page.
Type nothing into it, and don't press Accept on any permissions screen.
Tell IT now.
Use Outlook's Report button (Report, then Report phishing) and phone your IT contact too.
Disconnect if a file downloaded or opened.
Unplug the cable or turn off Wi-Fi, but leave it powered on to preserve evidence.
Run a full scan with your antivirus or EDR tool once IT gives the go-ahead.
Deny any MFA prompt you didn't start, and tell IT. If an admin has enabled Microsoft's Report suspicious activity setting, reporting the prompt flags the user as high risk.
Say so if you pressed Accept on a permissions request.
That is consent phishing: a malicious app gains access to your mail or files without your password, so IT needs to find and revoke it.
Not sure whether you typed anything? Assume you did. For the warning signs before a click, see how to spot a phishing email.
Entered your password? The first-hour checklist
A typed password means the attacker may already be signed in. Adversary-in-the-middle phishing kits relay the real Microsoft sign-in, MFA and all, and keep the session cookie. In a campaign Microsoft documented in 2022, payment fraud began as little as five minutes after the password and session were stolen. So a password reset alone is not enough. Each step needs a Microsoft 365 admin on a device that didn't open the link.
Block sign-in, then reset the password.
Microsoft prefers disabling the account until the investigation is finished (Block sign-in in the Microsoft 365 admin center). A block can take up to 24 hours to apply, while a reset stops new sign-ins immediately, so do both. Don't email the new password: the attacker may be reading the mailbox. If the account syncs from an on-premises Active Directory, reset it there, twice. App passwords survive a reset, so delete them.
Sign the account out everywhere.
Use Sign out of all sessions on the user's Account tab, or Revoke sessions in the Microsoft Entra admin center. Even then, an access token already issued can keep working until it expires, an hour by default, so don't treat the account as clean yet.
Remove MFA methods you don't recognise.
An attacker may register their own authenticator to get straight back in after a reset.
Revoke app consents you don't recognise.
Like a rogue MFA method, an approved malicious app is one of the ways back in that Microsoft's steps target.
Check admin roles and remove any the account shouldn't hold.
Remove forwarding and inbox rules, including hidden ones.
Microsoft's guide finds hidden ones by running Get-InboxRule with the IncludeHidden switch. Record what you find before deleting anything.
Read the sign-in and audit logs.
Check IP addresses, locations, times and outcomes in the Entra sign-in logs, then search the Defender portal audit log from just before the first suspicious activity, without filtering by activity at first.
Run a message trace and read Sent Items to see what the attacker sent and to whom. That becomes your list of people to warn.
Bring the account back carefully.
Reset the password again, re-enable the account and confirm MFA is enforced. If it was used to send spam, release it from the Restricted entities page.
Money moved or bank details changed? Call your bank first
If a payment has gone out, or someone changed the bank details on an invoice, phone your bank's fraud team before you touch the mailbox, and ask them to contact the receiving bank.
When the Australian Federal Police announced in September 2023 that it had returned $45 million to businesses targeted by cyber criminals over three years, it said victims who recovered money had contacted ReportCyber and their bank as soon as they realised, usually within 24 hours.
Then report it through ReportCyber at cyber.gov.au, call the real supplier on a number you already had, and keep every email as evidence. Our breakdown of a payment redirection scam shows how the switch is set up.
Who do you have to tell in Australia?
Some are legal duties, some just good sense. This is a starting point, not legal advice.
| Who | When | How |
|---|---|---|
| Your bank | Money moved, or bank details were exposed or changed | The fraud line, on a number from the bank's website or your card |
| ReportCyber | Any cybercrime, including a hacked mailbox used for fraud | Online at cyber.gov.au. For a live incident, the Australian Cyber Security Hotline: 1300 CYBER1 (1300 292 371) |
| IDCARE's Small Business Cyber Resilience Service | Businesses with 19 or fewer employees wanting free recovery help | A hotline referral, or 1800 595 170, Monday to Friday, 8am to 6pm AEST |
| The OAIC and the people affected | Personal information was accessed, serious harm is likely and can't be prevented, and the Notifiable Data Breaches scheme covers you | Assess within 30 calendar days; if it's notifiable, notify as soon as practicable |
| Your cyber insurer | You hold cyber cover | Early, per your policy's notification steps, before committing to costs you'll claim |
| People the attacker emailed | Messages went out from the compromised account | Phone key clients and suppliers, then warn the rest from a clean account |
| The ATO Client Identity Support Centre | A tax or BAS practice whose client data may be exposed | 1800 467 033, Monday to Friday, 8am to 6pm AEST |
| The Australian Signals Directorate | A ransom was paid and turnover is over $3 million, or you run critical infrastructure | A ransomware payment report within 72 hours |
The data breach scheme covers businesses and not-for-profits with annual turnover above $3 million, plus private health service providers, credit reporting bodies, credit providers and some smaller operators, such as tax file number recipients. The OAIC's quick reference guide sets out four steps: contain, assess, notify and review. Tax practices should also follow the ATO's breach guidance for tax professionals; our page on IT for accounting practices covers the rest.
How do you stop it happening again?
Close the gaps these attacks use:
Phishing-resistant MFA, starting with admins.
Microsoft says phishing-resistant methods such as passkeys deflect phishing in a way traditional MFA doesn't, and recommends them for every privileged account. See our guide to passkeys in Microsoft 365.
Conditional Access.
Require a compliant device and block sign-ins from places you don't operate. It needs Microsoft Entra ID P1 or Microsoft 365 Business Premium; every plan can at least switch on security defaults.
Block device code flow.
Microsoft recommends getting as close as possible to a complete block, after auditing genuine use in report-only mode. Our device code phishing explainer shows why ordinary MFA doesn't stop it.
Lock down app consent so staff can approve only verified-publisher apps asking for low-risk permissions, as Microsoft advises against consent phishing.
DMARC on your domain.
It won't save a hijacked mailbox, but once enforced it blocks fakes that spoof your exact domain. Start with SPF, DKIM and DMARC explained, or let our email security service set it up.
Someone watching the sign-ins.
Managed clients get Key IT's 24/7 SOC monitoring, which tracks Microsoft 365 sign-ins, MFA changes, mailbox rules and privilege changes, so a forwarding rule created at 2am raises an alert.
Know what is already exposed.
A free dark web scan shows which work addresses appear in known breaches.
Need help now?
Managed clients: call the Key IT helpdesk on 1300 053 948, Monday to Friday, 8am to 5pm, or log it through client support, and say it is a security incident. Outside those hours, the on-call engineers pick up urgent problems for managed clients, and 24/7 SOC monitoring carries on in the background.
Not a client yet? Phone 1300 053 948 and say you need incident response, or send us the details. Key IT's cyber incident response service helps contain a compromised account, find out what was accessed and work through the reporting.
Frequently asked questions
Is changing the password enough after a Microsoft 365 account is hacked?
No. A reset doesn't end sessions the attacker already holds, remove MFA methods or app consents they added, revoke app passwords, or delete their forwarding and inbox rules. Microsoft's response guide gives each of these its own step, and skipping one can leave the attacker a way back in.
I clicked a phishing link but didn't enter anything. Am I hacked?
Probably not, but report it anyway. A phishing page usually needs you to type a password, approve an MFA prompt or accept a permissions request before it can do damage. A link that downloaded or opened a file is different: disconnect that computer and let IT check it.
How do attackers hide inside a hacked mailbox?
Mostly with inbox rules. In one campaign Microsoft investigated, attackers created a rule that moved replies from their fraud targets into the Archive folder and marked them as read, so the real owner never saw them. Other rules quietly forward mail to an outside address.
Do we have to report a hacked email account in Australia?
Not always, but often. If personal information was accessed, serious harm is likely and you can't prevent it, a business covered by the Notifiable Data Breaches scheme must tell both the OAIC and the individuals at risk. Separately, a ransom payment must be reported to ASD within 72 hours where annual turnover exceeds $3 million.
Should we delete the attacker's emails and rules straight away?
Record first, then delete. Screenshot or export the rules, forwarding settings and suspicious messages, note the times, and keep the sign-in logs. That evidence shows what was accessed, which drives your reporting decisions, and your insurer, bank or police may ask for it.
Does MFA stop Microsoft 365 accounts being hacked?
It blocks attacks that rely on a stolen password alone, but not every kind of phishing. Fake sign-in pages can relay your MFA approval and steal the session, and device code phishing tricks you into signing in for the attacker. Passkeys resist the first; a Conditional Access block on device code flow shuts out the second.
More insights
AI-powered phishing
AI phishing makes scam emails flawless, so 'spot the typo' no longer works. The new warning signs…
Read article →PhishingDevice code phishing
Device code phishing gets past MFA and even passkeys in Microsoft 365. See how it works, what ASD…
Read article →ScamsSPF, DKIM and DMARC explained
SPF, DKIM and DMARC explained in plain English: stop scammers sending email as your business, keep…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.