Did someone compromise my UWin Account?

If you believe someone may have gained access to your University of Windsor Microsoft work/school account, it is important to act immediately. Quick action can help prevent unauthorized access to your email, files, Teams conversations, and other university resources.

Signs that your account may have been compromised include:

• Receiving unexpected multi-factor authentication (MFA) prompts
• Password change notifications that you did not initiate
• Sign-in notifications from unfamiliar locations or devices
• Emails sent from your account that you did not send
• Missing, altered, or deleted emails or files
• Reports from others about suspicious messages coming from your account

Step 1: Change Your Password Immediately

If you can still sign in to your account:

1. Go to account.uwindsor.ca portal.
2. Sign in using your University of Windsor credentials.
3. Navigate to Change Password.
4. Change your password to a new, strong password that has never been used before.

When selecting a new password:

• Use a unique password that is not used for any other website or service.
• Avoid using personal information such as names, birthdays, or phone numbers.
• Choose a password that is difficult for others to guess.

If you are unable to sign in, contact the IT Service Desk immediately for assistance.

Step 2: Review Recent Sign-In Activity

Microsoft allows you to review recent account activity to identify suspicious sign-ins.

1. Go to the Microsoft My Account portal (myprofile.microsoft.com).
2. Select My Account or MRecent Activity.
3. Review recent sign-in activity, including:
   • Date and time
   • Location
   • Device type
   • Application used

Look for:

• Sign-ins from countries or regions you do not recognize
• Sign-ins at times when you were not using your account
• Unexpected devices or applications

If you identify suspicious activity, report it to the IT Service Desk.

Step 3: Review Your Authentication Methods

Verify that only authentication methods you recognize are registered to your account.

1. Go to the Microsoft My Account portal.
2. Open Security Info.
3. Review all registered authentication methods.

Check for:

• Unknown phone numbers
• Unknown Microsoft Authenticator registrations
• Unknown passkeys
• Unknown security keys

If you find any authentication method that you do not recognize, remove it and contact IT Service Desk immediately.

Step 4: Add a Passkey for Better Protection

Passkeys provide stronger protection than passwords because they are resistant to phishing attacks and cannot be easily stolen through fake sign-in pages.

To add a passkey:

1. Go to the Microsoft My Account portal.
2. Open Security Info.
3. Select Add sign-in method.
4. Choose Passkey.
5. Follow the prompts to register a passkey on a supported device or security key.

A passkey can be stored on:

• A FIDO2 security key
• A mobile device
• A supported device ecosystem that synchronizes passkeys

Whenever possible, use a passkey as your primary sign-in method.

Step 5: Check for Unexpected Changes

After securing your account, review for any unauthorized changes:

Email

Check for:

• Messages you did not send
• Unexpected forwarding rules
• Deleted messages
• Changes to your mailbox settings
• Mail rule you did not create

Files

Check for:

• Missing files
• Unexpected file sharing activity
• Modified documents that you did not edit

Teams

Check for:

• Messages you did not send
• Unknown chats or conversations
• Unexpected meeting invites

Step 6: Notify the IT Service Desk

Contact the IT Service Desk as soon as possible if:

• You confirmed suspicious sign-in activity
• Your password was changed without your knowledge
• An unauthorized authentication method was added
• You cannot access your account
• You believe sensitive university information may have been exposed

Provide as much detail as possible, including:

• Dates and times of suspicious activity
• Screenshots when available
• Any sign-in alerts or notifications received

Preventing Future Account Compromise

To help protect your account:

• Use a unique password.
• Never approve unexpected MFA prompts.
• Be cautious of links and attachments in emails.
• Regularly review your sign-in activity.
• Keep your devices updated.
• Register and use a passkey whenever possible.

Need Help?

If you have questions or believe your account may have been compromised, contact the University of Windsor IT Service Desk immediately. Early reporting greatly increases the likelihood of preventing further unauthorized access and protecting university data.