You gave your password to someone, and now you know they weren’t who they said.

What they got decides what they can do

• The password only. If the account asks for a second step, they can start a sign-in and wait for you to approve it. Your phone showing a prompt you didn’t start is the sign of that. The prompts page covers it.
• The password and a code or an approval you gave. They now have a signed-in session, and it can keep working after you change the password.
• The password and remote access to the computer. The FTC’s advice for this case is to update your security software, run a scan, delete what it identifies, and change your passwords, from a different device if you can.
• The password and a payment. Call the bank first. The money page has the order.
• You can’t tell what they got. Treat it as the row above it. Ask the people who were on the call or watched the screen, and write down what each remembers, with the time.

The order to change things

Change email first. A person with your inbox can ask other services to send password reset links to it, change those passwords, and lock you out, which is the reason the FTC gives for putting email first.

A coworker who shares that login, or a shared mailbox the password opens, is part of the same answer. List every place the password worked and who else uses it, because each one gets the same changes.

1. From a computer or phone that was not part of the call or the page, change the password on the account you gave away. Type the address of the sign-in page yourself.
2. Change it everywhere else that password was used. The FTC says to update any other account that reuses it.
3. Ask whoever administers Microsoft 365 to end the account’s active sessions. Microsoft’s documentation says revoking sessions invalidates active access using the stolen credentials.
4. Look at the sign-in methods on the account and remove any phone number, app, or device you didn’t add.
5. Tell the person who handles your IT, and your bank if the account touches money. CISA lists both.

Three things a reset leaves behind

• App passwords. Microsoft says they aren’t revoked automatically when the password is reset. Someone has to delete and recreate them.
• A reply address or recovery number the scammer added. The FTC says to confirm that every recovery email and phone number is one you entered and can reach.
• An account synced with a server in your office. Microsoft says to reset that password in the on-premises directory, and to do it twice. The second reset covers the delay in copying the first. If your IT provider runs that server, ask them. If you’re not sure, that is the question to bring.

Don’t send the new password by email

Microsoft’s instruction to administrators is not to email the new password to the user, because the attacker may be reading the mailbox at that point. Hand it over in person or by phone. The same applies when you set one for a coworker.

If the scammer already changed it

If you can’t sign in, use the email provider’s own recovery process, and have your administrator reset the work account from the admin side. The FTC suggests starting with the provider’s recovery page for the service.

What this does and doesn’t cover

These steps stop the next sign-in and end the sessions that are open. They don’t tell you what someone read or sent while they had access. For that, the Sent Items, the rules, and the audit log need to be read from the time you gave the password. We do that with you and tell you what we found and what we didn’t, with the dates.

Each step above is measured from one point, the time you gave the password, so write that time down first.

Related

• Sign-In Approval Prompts on Your Phone You Didn’t Start
• Business Email Hacked: Take the Account Back in Order
• Money Sent to a Fraudster: What to Do Today
• Who to Tell After a Security Incident, and in What Order

Sources

• FTC: What To Do if You Were Scammed
• FTC: How To Recover Your Hacked Email or Social Media Account
• CISA: Avoiding Social Engineering and Phishing Attacks
• Microsoft Learn: Respond to a compromised email account in Microsoft 365
• Microsoft Learn: Revoke user access in an emergency