microsoft account compromised

Take immediate steps to secure the account and then use the official recovery paths.

1. Secure all devices first

• Run a full antivirus/malware scan on every device that has accessed the Microsoft account (PC, phone, tablet).
• If using Windows 8.1 or Windows 10/11, turn on and run a full scan with Windows Defender as described in the guidance for compromised accounts.
• Do this before changing any passwords to ensure the attacker is not still capturing credentials.

2. Change or reset the Microsoft account password

• If sign-in is still possible, go to the Microsoft account security page and change the password to a strong, unique one using the steps in the hacked/compromised account article.
• If sign-in is not possible, use the official password reset flow:
  • On the sign-in page, select Forgotten your password? or use the Reset password link from the password reset article.
  • Enter the account username and select Next.

3. If text verification and recovery code do not work

• During password reset, when asked to verify identity, choose an available verification option.
• If no usable verification options appear, or access to them is lost, use the sign-in helper tool referenced in the password reset article to continue recovery.
• If verification codes are not arriving or failing, follow the verification code troubleshooting guidance linked from the sign-in and locked-account articles.

4. If the account is locked or access is blocked

• If the account is locked due to suspicious activity and the normal Next option does not appear, follow the aka.ms link shown on the lock screen to submit the reinstatement form. A Microsoft Online Safety agent will review the request and respond by email.
• Do not submit multiple reinstatement forms in parallel, as this can slow down processing.

5. If the account is clearly hacked/compromised

• Follow the dedicated compromised-account steps:
  • Step 1: Clean devices (antivirus/Defender full scan).
  • Step 2: Change or reset the password using the official reset flow.
  • Step 3: After regaining access, review account settings such as connected accounts, forwarding, and automatic replies to remove anything the attacker added.

6. If recovery keeps failing

• Use the Microsoft account recovery form as guided in the “I can’t sign in” article and the Q&A references. Provide as much accurate historical information as possible (old passwords, contacts, subjects, etc.).
• If the recovery form and helper tools fail and the attacker has replaced all security info, Q&A guidance indicates there may be no additional method for Microsoft Support to restore access to a consumer account.

After regaining access, enable and carefully configure two-factor authentication, ensure recovery email/phone are correct, and monitor recent sign-in activity for any further suspicious logins.

References:

• How to recover a hacked or compromised Microsoft account
• Reset a forgotten Microsoft account password
• I can't sign in to my Microsoft account
• Microsoft account has been locked
• My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
• Unable to change password in my Outlook - Microsoft Q&A
• my microsoft account has been compromised - Microsoft Q&A
• My account got hacked - Microsoft Q&A
• I need to speak with a real person and it seems impossible. - Microsoft Q&A