Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
For a hacked Microsoft/Xbox account with ongoing unauthorized purchases and no effective resolution yet, the only supported paths are:
- Secure all devices and accounts
- Run a full antivirus/malware scan on every PC or device used to sign in to the hacked Microsoft/Xbox account, using Windows Defender or another up-to-date antivirus.
- After the scan completes, change the password of every related account (email, PayPal, etc.).
- Follow the official hacked-account recovery process
- Use the official guide for compromised Microsoft accounts: How to recover a hacked or compromised Microsoft account.
- Complete all steps:
- Step 1: Clear malware (as above).
- Step 2: Try to sign in and change the password. If sign-in fails, use the password reset flow from the article.
- Step 3: Once/if access is restored, immediately review account settings (connected accounts, forwarding, automatic replies) and remove anything suspicious.
- If recovery fails, use the Account Recovery form repeatedly
- If the standard sign-in and reset paths do not work, use the Microsoft Account Recovery form (ACSR) referenced in the guidance for unsuccessful recovery: Account recovery unsuccessful.
- Before submitting again, review the official tips for filling out the form (linked from that page) and provide as many accurate details as possible (old passwords, approximate creation date, services used, etc.).
- The form can be submitted up to two times per day. If a previous attempt was rejected, adjust the information based on the guidance before resubmitting.
- If the form cannot be used because the additional security info is unrecognized, use the Sign-In Helper linked from the same page.
- Use the Sign-in Helper for support options
- For any “account hacked” or “we couldn’t find an account” situation, use the Sign-in Helper: Open the Sign-in Helper for support options or hacked account issues.
- Enter the hacked account’s email/phone and follow the flow; it will either provide self-service steps or options to contact an agent, depending on eligibility.
- Stop further unauthorized sign-ins and access
Once/if access to the Microsoft account is restored:
- Sign in to the Microsoft account security page and:
- Change the password again to a strong, unique one.
- Enable two-step verification / Microsoft Authenticator.
- Use “Sign out everywhere” (if available) to invalidate all active sessions.
- In Outlook.com (if used), check:
- Settings → Mail → Rules and delete any suspicious rules.
- Mail → Forwarding and remove any unknown forwarding addresses.
- Remove any unknown connected accounts.
- Sign in to the Microsoft account security page and:
- Address Game Pass and Xbox purchases
- Once the account is either recovered or confirmed unrecoverable by the official process, contact Microsoft Support via the “Get Help”/“Contact Support” path described in the Q&A examples to:
- Dispute fraudulent Xbox charges.
- Request cancellation of the active Game Pass subscription on the compromised account.
- Be prepared to confirm that the payment method (e.g., PayPal) has been secured (password changed, unauthorized transactions reported to PayPal).
- Once the account is either recovered or confirmed unrecoverable by the official process, contact Microsoft Support via the “Get Help”/“Contact Support” path described in the Q&A examples to:
- If the account cannot be recovered
- If the official hacked-account guide and recovery form ultimately fail, there is no alternative supported method to regain access; support agents cannot bypass security or directly reset the account.
- In that case, continue working with the payment provider (PayPal) for charge disputes and ensure the payment method is removed from any remaining Microsoft/Xbox profiles that are under control.
These are the only supported ways to:
- Attempt to regain control of the hacked Microsoft/Xbox account.
- Stop or dispute unauthorized purchases.
- Work toward canceling subscriptions like Game Pass on that compromised account.
References:
- How to recover a hacked or compromised Microsoft account
- Account recovery unsuccessful
- Hello , welcome to Account help & learning
- Hacked account - Microsoft Q&A
- hello my email was (Moderator note: PII removed)@icloud.com and now its (Moderator note: PII removed)@jerkoffmail.com can please someone help me and the team change it my username in xbox is (Moderator note: PII removed) please help me team and change it - Microsoft Q&A
- Cannot Access Microsoft Account After Hacker Changed Email, Advice Needed - Microsoft Q&A
- fraud charges on microsoft account - Microsoft Q&A
- Hacker set up continuous draft ransomware email - Microsoft Q&A