My Microsoft Account uses a verification email that is not connected to the account

Question

My Microsoft Account uses a verification email that is not connected to the account

Ronius 0

So long story short my account got stolen and after I contacted Microsoft Support multiple times the account got suspended. They changed the email of the account from mine to theirs. A few days later I made an account with the email that I had before the account got hacked, I thought everything would be fine. But every time I try to log in it gives me an option to send a code to the hacker's email address to "verify" it. I checked every sign-in option and that email was nowhere to be found. It might be a bug, or it might be a sign that the hacker can still somehow access my account. Hoping someone would help

0 comments

1 answer

Your answer

Answer 1

The behavior described matches a hacked/compromised Microsoft account where the attacker has changed the primary alias and security info. When that happens, the attacker’s email can continue to appear as a verification option even if it is no longer visible to the legitimate owner, and support agents cannot manually override or remove it.

For a consumer Microsoft account, only the official automated recovery and hacked‑account process can restore access or fully detach the hacker’s email:

Follow the hacked/compromised account guidance and recovery flow described in the official article:
- Use the “How to recover a hacked or compromised Microsoft account” path (via the guidance in the Q&A reference) and complete the account recovery form (ACSR) with as much accurate detail as possible (old passwords, typical contacts, subject lines, purchase info, devices, and locations used).
- Submit the form from a device and network commonly used with the account.
If the recovery form is rejected or the system says the account does not exist, and the hacker has replaced all security info, there is no other supported method for Microsoft to remove the attacker’s email or restore access. Support agents are not allowed to bypass or change account details for security reasons.
If the account cannot be recovered, focus on damage control:
- Treat the old account as permanently compromised.
- Inform contacts (from another email or channel) that the old address is no longer under control.
- Move subscriptions, game licenses, and services to a new, secure Microsoft account where possible (for example, by contacting product‑specific support such as Minecraft or Xbox support, as suggested in the Q&A reference).

The presence of the hacker’s email as a verification option does not by itself prove they still have access to the new account created with the old email address; it reflects how Microsoft’s identity system still associates that alias or security info with the original, compromised account. Only successful account recovery can remove that association.

References: