A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
The only supported way to recover a hacked Microsoft account is through the official self-service recovery and hacked-account flows. If the attacker has changed the sign-in email/alias and replaced the security info, and the standard recovery form no longer recognizes the original alias, there is no alternative manual recovery path through support.
Follow these steps, in order:
- Use the hacked/compromised account troubleshooter
- Go to the official guide: How to recover a hacked or compromised Microsoft account.
- Start the sign-in helper tool (the Start button in the article).
- Enter the email address or phone number that was originally used on the account. The tool will either:
- Show self-help steps, or
- Offer the option to talk to an agent (where available), but agents cannot override the automated recovery system or restore removed aliases.
- Submit the account recovery form with maximum detail
- If prompted, complete the Microsoft account recovery form. Use all information remembered about the account:
- Old passwords.
- Services used (Outlook.com/Hotmail, Skype, Xbox, Microsoft Store, etc.).
- Contacts and exact email subject lines if Outlook.com/Hotmail was used.
- Any Xbox console hardware ID if the account was used on Xbox.
- Answer as many questions as possible and use the “add more” options to provide extra details. Wrong answers do not count against the request.
- If the request is not approved, it is possible to try again (up to two times per day), ideally from a familiar device and network previously used with the account.
- If prompted, complete the Microsoft account recovery form. Use all information remembered about the account:
- Understand the limits if security info and alias were fully replaced
- If the attacker removed the original alias and replaced all security info, and the recovery form cannot validate ownership, the account may become unrecoverable.
- Microsoft support agents and advocates are not allowed to reset passwords or change account details and cannot bypass the automated recovery system.
- If recovery succeeds
- Follow the instructions sent to the working email specified in the recovery form.
- After regaining access, immediately:
- Change the password and set a strong password.
- Review and update security info (phone, alternate email, Microsoft Authenticator, etc.).
- Check connected accounts, forwarding, and automatic replies for malicious changes.
If repeated submissions of the recovery form fail and the hacked-account troubleshooter cannot validate ownership, there is no further escalation path to a separate “account recovery/security team” that can override these systems.
References:
- How to recover a hacked or compromised Microsoft account
- Help with the Microsoft account recovery form
- My username and password have stopped working
- My account got hacked. - Microsoft Q&A
- Cannot Access Microsoft Account After Hacker Changed Email, Advice Needed - Microsoft Q&A
- My account got hacked - Microsoft Q&A
- Need help with hacked microsoft account - Microsoft Q&A