Is my Outlook or Hotmail account hacked? Check and secure it
2 min read · Updated October 15, 2026
Sign in to your Microsoft account’s security page and review recent activity. In Outlook settings, look for unknown mail rules and forwarding. If anything looks suspicious, change your password, sign out everywhere and turn on two-step verification or a passkey.
One account, many services
Outlook.com and Hotmail addresses are Microsoft accounts. The same login can open OneDrive, Microsoft 365 and Xbox, so a takeover can reach beyond your mailbox. That raises the stakes for securing it.
What to check
- ✓Recent activity in your Microsoft account security settings.
- ✓Outlook rules and forwarding, which attackers use to hide or copy mail.
- ✓Alias and recovery details you did not add.
- ✓Devices and apps connected to the account.
Check your email address for known leaks
Works with any provider. Enter your address, get a free exposure check, and see what to fix first.
Lock it down
Change the password, sign out of all sessions and enable two-step verification. Microsoft also supports passwordless sign-in options, which remove the password from the equation. Review which apps have permission to your mailbox and remove those you do not use.
Look beyond the inbox
Check subscriptions, payment methods and linked services such as Xbox or OneDrive for changes. If your payment details are stored, review recent charges.
Frequently asked questions
Are Hotmail and Outlook the same?+
They are different addresses on the same Microsoft account system and share security settings.
Can I see recent sign-ins?+
Yes. The security area of your Microsoft account shows recent activity, including location and device details.
What if I lost access completely?+
Use Microsoft’s official account recovery form and provide as much accurate information as you can.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.