Microsoft account hacked and hacker turned on two step verification

When two-step verification has been enabled by someone else and all security info (email/phone/authenticator) now points to accounts that cannot be accessed, Microsoft’s consumer-account security model does not allow manual override by support. If the recovery form has already been tried multiple times and is consistently unsuccessful, there is no additional escalation path to regain that specific Microsoft account.

Key points from Microsoft’s guidance:

1. If two-step verification is on and none of the verification methods are accessible, support cannot reset the account
   • The official guidance states that if two-step verification was turned on and none of the alternate methods to get a verification code can be accessed, support agents are not allowed to send password reset links or change account details. This is by design to protect accounts from social-engineering attacks.
   • See: “If you have turned on two-step verification and cannot access any of the alternate methods to get a verification, we cannot help you… our support agents are not allowed to send password reset links, or access and change account details.”
2. The account recovery form is the only recovery path
   • The Microsoft account recovery form (ACSR) is the only supported way to prove ownership when normal sign-in and reset options fail.
   • If the form is repeatedly rejected, or the system reports that the account does not exist or cannot be recovered, there is no further manual override.
   • Guidance is to:
     • Use a familiar device and location.
     • Provide as much accurate historical information as possible (old passwords, contacts, subject lines, etc.).
   • If this has already been done multiple times without success, Microsoft’s own documentation and Q&A responses confirm that the account cannot be restored.
3. When a hacker has replaced security info and recovery fails, the account is effectively lost
   • In similar cases where a hacker changed the primary alias and security info, moderators confirm that if the account recovery web form does not work, and security info has been replaced, there is no other working method to recover the Microsoft account, and Microsoft Support cannot help either.
4. Next steps and damage control
   • Follow the hacked/compromised account guidance for any other accounts or devices:
     • Run a full antivirus/malware scan on all devices used with that account.
     • Change passwords and enable two-step verification on other important accounts (email, banking, etc.).
   • For Minecraft or Xbox purchases tied to the lost account:
     • The Microsoft account itself cannot be restored if recovery fails, but Minecraft-specific support may be able to advise on options for game access or migration. (This is separate from Microsoft account recovery and is handled by Minecraft Support.)
   • For future accounts:
     • Turn on two-step verification early and keep multiple, up-to-date recovery methods (phone, secondary email, authenticator) under personal control.

Given the information and Microsoft’s documented policies, if the recovery form has already been exhausted and two-step verification is locked to the attacker’s info, the only remaining option is to secure devices and other accounts, create a new Microsoft account, and work with product-specific support (for example, Minecraft) to see if any accommodations are possible for purchases.

References:

• Help with the Microsoft account recovery form
• How to recover a hacked or compromised Microsoft account
• Cannot Access Microsoft Account After Hacker Changed Email, Advice Needed - Microsoft Q&A
• hello my email was (Moderator note: PII removed)@icloud.com and now its (Moderator note: PII removed)@jerkoffmail.com can please someone help me and the team change it my username in xbox is (Moderator note: PII removed) please help me team and change it - Microsoft Q&A