Account Compromised – Immediate Assistance Required

Question

Account Compromised – Immediate Assistance Required

Zsombor Nagy 0

Hello,

My account has been compromised and I no longer have access to it.

Two-Step Verification was enabled without my permission, and I am unable to recover the account using standard methods. I am the original owner and can provide full verification details such as previous passwords, billing information, devices used, and location.

This is a security issue involving unauthorized access, not a standard recovery request. I am asking for this case to be escalated to the appropriate security team for manual review.

Please do not close this case without proper investigation.

I expect a response from a real agent.

Sincerely,
[Zsombor]

0 comments

1 answer

Your answer

Answer 1

For a compromised personal Microsoft account where two-step verification or security info was changed without authorization, only the official automated recovery and security flows can be used; manual escalation to a security team or agent-based override is not available for consumer accounts.

Follow these steps:

Use the Sign-in Helper and hacked-account guide

Go to the hacked/compromised account guide and start with the Sign-in Helper tool. It will ask for the email/phone and route to the correct self-help or support options.
Reference: “How to recover a hacked or compromised Microsoft account” describes this flow and is the official entry point.

Run malware checks on all devices used with the account Before changing any passwords or attempting recovery again, scan all PCs/phones/tablets used with the account:

Ensure antivirus is up to date.
Run a full scan on each device.
On Windows 10/11 or 8.1, Windows Defender can be used by searching for “Windows Defender” from Start and following the prompts. This helps ensure an attacker is not still capturing credentials.

Attempt password reset or sign-in again

After devices are clean, try to sign in and use the standard “forgot password” / reset options.
If sign-in is possible, immediately:
- Change the password to a strong, unique one.
- Review and correct account settings such as connected accounts, forwarding, and automatic replies.

Use the Microsoft Account Recovery form (ACSR) If normal reset fails because security info or 2FA was changed:

Use the Microsoft account recovery form.
Complete it from a device and location commonly used with the account.
Provide as much detail as possible: previous passwords, contacts, subject lines, billing details, and other requested information.
A working alternate email is required so Microsoft can send updates about the request.
Microsoft reviews the form and responds, typically within 24 hours.

Important limitations:

If two-step verification is enabled and none of the verification methods are accessible, support agents cannot bypass or reset security; they cannot send manual reset links or change account details.
If the recovery form is repeatedly unsuccessful and all security info has been replaced by the attacker, the account may not be recoverable.

If security info change is pending If a “security info change is still pending” message appears:

Use the built-in options on that screen, such as:
- “Cancel this request” (if the change was initiated legitimately and old security info is still accessible), or
- “Let us know” (if the change was unauthorized) to go through the unauthorized-change flow.

Damage control outside the account While recovery is in progress or if recovery fails:

Inform contacts via another email, phone, or social media that the account is compromised and that they should ignore suspicious messages from it.
Monitor other accounts (banking, social, other email) that may have used the same password or email; change passwords and enable MFA where possible.

For direct assistance:

Use the Sign-in Helper and support entry points described in the hacked-account and recovery-form articles. These can route to chat with a support agent in some cases, but even agents must follow the same security rules and cannot override failed automated verification.

References: