Managing personal Outlook.com account settings, security, and privacy
@Ultra_Voltage said
[Account Recovery Form] doesn't work if the email that has been hacked has 2-step verification
Unfortunately you are correct. Your only other option, if you can complete one of the verification methods is an Account Security Reset.
If you can complete one verification step for your account (e.g. password), but can't access any of the other verification methods, and have repeatedly failed the Account Recovery process, or can't use Account Recovery because your account has Two-step Verification (2FA, MFA), then you can try to request that all the verification methods be replaced.
This will put your account in a 30 day "Pending Request" state. You will have limited access to the account during this period or no access at all if the account has Two-step Verification enabled.
See the Answer by "Hornblower409 Jun 25 2026" in
https://learn.microsoft.com/en-us/answers/questions/5920985/how-to-fix-we-will-send-a-verification-code-to-(mo