I can't remove, amend or add new rules to my outlook account

Ryan Ward 0 Reputation points
2025-08-28T15:04:34.6566667+00:00

My account was hacked and has since been recovered. The hacker has created a rule under the name of "idtienphuoc 1" which auto-forwards all of my emails to a third-party email address.

I've tried deleting this, amending it and even trying to create an alternate rule to try and counteract the one above - all to no avail.

I've spent the best part of today trying to fix the issue, even downloading MFCMAPI and following the step-by-step process to resolve the issue, also to no avail. I can't get anyone on the phone or live chat from Microsoft to resolve the issue, so this is my last port of call/hope.

Outlook | Web | Outlook.com | Email
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Kal-D 1,115 Reputation points Microsoft External Staff Moderator
    2025-08-28T19:56:32.0733333+00:00

    Dear Ryan Ward

    Thank you for reaching out to the Q&A Forum!

    I'm sorry to hear about the trouble you're having with your email account and the persistent forwarding rule. Dealing with a compromised account is stressful, and it's even more frustrating when a malicious rule won't go away.

    Since you've already tried several common solutions, including using MFCMAPI, we'll need to approach this from a different angle. The key is to find and remove the rule, which may be hidden or more deeply embedded than a standard rule.

    Phase 1: Investigate Potential Hidden Rules

    First, let's confirm the hacker didn't set up another type of forwarding.

    • Check "Connected Accounts": Hackers can sometimes link a secondary email address to your account. Go to your mail settings and look for an option like "Sync email" or "Connected accounts." Make sure there aren't any unauthorized accounts listed there that could be pulling your emails.
    • Check for Rules in Subfolders: While most rules are in the main inbox, a hacker could have created a rule that only applies to a specific subfolder. Go through each of your folders and check the rule settings for any forwarding rules.

    Phase 2: Advanced Rule Deletion

    Since you've already used MFCMAPI, let's consider the possibility that the rule is more difficult to find.

    • Look for a "Hidden" Rule: Sometimes, a rule is created with a non-standard name or is marked as hidden. When using MFCMAPI, you need to go to the "Associated Contents Table" to view these. It's not a straightforward process, but it's where these types of rules often hide. A professional support agent would be able to navigate this with you, but without that, we have to proceed with caution.
    • Create a Conflicting Rule: You mentioned trying to create a new rule, but let's try a different approach. Create a rule with the highest priority that says, "When an email is received from anyone, move it to the Junk folder." This may force your new, overriding rule to execute before the forwarding rule, effectively stopping the email from being forwarded.

    If none of these steps work, the issue may be on the server-side, requiring a direct intervention from Microsoft support. You've mentioned a lack of success with live chat, but sometimes reaching out via social media channels or a dedicated support request form can get a faster response.

    I know this is a lot to take in, but please try these steps and let me know how it goes. We can work together to get this resolved.

    Please don't hesitate to reach out if you require further assistance.

    Warm regards, 

    Kal Duong | Microsoft Q&A Support Specialist

    ==========================================================

    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.