Solved Sign in activity

Regards to all! I have protected my microsoft account as much as possible. However, I constantly have attempts to break into my account (I don't know for what reason). Can it be stopped or not? Thanks in advance!

uco73 said:

Regards to all! I have protected my microsoft account as much as possible. However, I constantly have attempts to break into my account (I don't know for what reason). Can it be stopped or not? Thanks in advance!

Click to expand...

I don't know if it will help, but you can let MS know that it was an unrecognised sign in attempt. Click on each unsuccessful attempt in turn, click on 'secure your account'. MS will say 'Thanks for telling us....'. I don't know what they'll do with the information, but it's possible that they may block further attempts from that IP address. My only unsuccessful sign-ins are all my own doing - clumsy finger

Unfortunately, this activity is now normal and expected if your MS Account username was exposed as an e-mail address anywhere, due to a 3rd-party website's data leak. Bots will constantly probe your account.

But if you have Two-Factor Authentication or enabled a 2FA app like Microsoft Authenticator, then it's more difficult for these automated attempts to get in. Any account, whether its MS, Google or Apple will be tested by outsiders. It's same reason why we have network firewalls. They're not targetting you specifically, all the bots are working off a list of harvested email addresses.

I see the same attempts in my account.
I have since moved onto passwordless login.
I use my phone to authenticate all my logins.

It's my opinion that once one's MS account user name (or any email address) is out there in the wild, there's no stopping attempts to hack into it as it's being sold indiscriminately across the web. All we can do is actively monitor our accounts to make sure none has been successful in getting in.

Even if you get a new MS account and delete the old one, the first time you use it to do anything other than sign into your computer, unless you use it properly, it's short order before it's out there and it all starts over again.

Year's ago, I got so fed up with email hacking I set up a 3 step approach that has worked out for me.

The only places who have my MS account user name are my financial sites.

I have a second email account for email to my regular contacts and for sites I regularly visit like Amazon, Ebay, this forum, etc, sites I know whose data is 99.9% protected.

I have a third account I call my throwaway and it's used for any site and in any instance I have my doubts how my information will be used and distributed. All my junk email goes into this account.

Bree said:

I don't know if it will help, but you can let MS know that it was an unrecognised sign in attempt. Click on each unsuccessful attempt in turn, click on 'secure your account'. MS will say 'Thanks for telling us....'. I don't know what they'll do with the information, but it's possible that they may block further attempts from that IP address.

Click to expand...

These days, that approach is in vain. The reason you see all those worldwide regions is hackers constantly rotate through small ISP's in countries with weak enforcement of cyber laws, and hosting providers with limited IT resources. Whenever MS detects a flood of failed logon activities from a network, that network is eventually blocked. Then the hackers abandon it and start again at another ISP (or under a new identity). Rinse and repeat.

MS provides you a "report this" link, but honestly it's not going to make a difference. They know it, but maybe it makes you feel better clicking on it.

uco73 said:

However, I constantly have attempts to break into my account (I don't know for what reason).

Click to expand...

It might be a service or an app. When I used app password in Outlook, MS reported the same.
Have you ever logged in using MS account? https://account.microsoft.com/privacy/app-access

glasskuter said:

Even if you get a new MS account and delete the old one, the first time you use it to do anything other than sign into your computer, unless you use it properly, it's short order before it's out there and it all starts over again.

Year's ago, I got so fed up with email hacking I set up a 3 step approach that has worked out for me.

The only places who have my MS account user name are my financial sites....

Click to expand...

I only ever use my MS account to sign in to Microsoft and their various services.

My approach is to use my Yahoo Mail account's 'temporary addresses' feature, a different one for each new site I sign in to. When I say 'temporary', it's effectively a permanent address until if/when it becomes a spam magnet. All mail to any of my aliases arrives in my Inbox by default, unless I choose to filter it to another folder. Should one get on a spam list I can just throw it away and create a new one. I am currently using 74 different aliases.

I've been following this approach for well over 10 years. I get virtually no spam, I think I've only ever had to delete one of my aliases.

One thing you can do is to change how you sign into MS account, i.e. "Manage how you sign in to Microsoft" (goto Your Info Page -> Edit Account Info), and then change all the info that you can change. For example, instead of using a real email account, use an alias, or a dot address. Give your phone as a "recovery" phone, but don't give as an account phone so it doesn't show up on this page.

I solved the problem. I changed my e-mail and set up passwordless login via MS auth. For now, everything is as it should be. Thanks a lot for the answers. You are the best!