Locked out of Microsoft account

The behavior described strongly indicates that the Microsoft account backing the Xbox profile is compromised and that an attacker still has control (for example via existing sign‑in sessions, devices, or recovery info). With the current recovery options gone (old phone and email deactivated), only the official automated recovery and security processes can help; there is no supported way to “speed up” or bypass the security timeframes.

Actionable steps based on the documented process:

1. Treat the account as hacked/compromised
   • Follow the official hacked/compromised account guidance:
     • Start from the compromised-account flow: https://go.microsoft.com/fwlink/?linkid=2196140 (from context) which will typically lead to:
       • Resetting the password.
       • Reviewing and removing suspicious security info and sign‑in methods.
       • Checking for forwarding rules or other changes.
   • If the attacker keeps changing the password, it means they still have a way to sign in or reset it; all recovery and sign‑in methods must be reviewed and cleaned.
2. Use the Microsoft account recovery form correctly
   • If normal reset flows are not stable, use the account recovery form:
     • Account recovery form: https://go.microsoft.com/fwlink/?linkid=2288285
   • Before filling it out:
     • Ensure access to a separate working email address where Microsoft can contact about the request. This can be any active email, including a newly created Outlook.com address.
     • Use a device and location previously used to sign in to this Microsoft account (for example, the usual PC or network at home). This increases the chance of successful verification.
   • The form is fully automated and designed to ask questions only the real owner can answer. If the information is insufficient, the request will be denied and the account may become effectively unrecoverable.
3. Understand the limits of support and 2‑step verification
   • If two‑step verification is enabled and none of the alternate verification methods are accessible, support agents cannot override this or send manual reset links. In that case, the account cannot be recovered.
   • If two‑step verification is not enabled and the verification options shown during reset are not recognized, the Sign‑in Helper tool should be used: https://go.microsoft.com/fwlink/?linkid=2214157.
   • Support agents and forum moderators cannot directly unlock, take over, or modify personal Microsoft accounts beyond what the automated flows allow.
4. Dealing with lockouts, rate limits, and blocks
   • Repeated attempts and unusual activity can trigger temporary blocks or “try another verification method” messages.
   • To avoid making things worse:
     • If a block or rate limit is hit, wait at least 24 hours (and up to several days) before trying again.
     • Do not keep submitting the recovery form or requesting codes repeatedly; this can extend the lockout.
     • If possible, try from a different network (switch between Wi‑Fi and mobile data, or use a different Wi‑Fi) and, if available, a different verification method (alternate email instead of SMS, etc.).
5. About keeping the Xbox powered on and waiting 30/60 days
   • Changing security info (like recovery email/phone) can involve enforced waiting periods for security reasons. These waiting periods cannot be shortened or bypassed.
   • Keeping an Xbox console powered on for 30–60 days does not change how Microsoft’s account security systems work. The key is to:
     • Secure the account fully (remove attacker access) once a stable sign‑in is achieved.
     • Update security info following the official flows and then wait out any required security delay.
6. If recovery ultimately fails
   • If the recovery form repeatedly fails and the compromised-account process does not restore control, the account may be unrecoverable. This is explicitly documented: if the automated systems cannot validate ownership, support cannot override the decision.
   • In that case, the only remaining option is to create a new Microsoft account and secure it from the start (strong unique password, up‑to‑date phone and email, and carefully protected two‑step verification).

Summary of what can actually be done:

• Use the compromised-account flow and recovery form from a known device and location, with a separate working contact email.
• Provide as much accurate historical information as possible in the recovery form.
• Avoid repeated rapid attempts; respect any lockout periods.
• Once access is regained, immediately review and update all security info and sign‑in methods, then wait out any enforced security-change delays.
• If the automated recovery continues to fail, the account is treated as unrecoverable and must be replaced with a new Microsoft account.

References:

• Help with the Microsoft account recovery form
• Microsoft account has been locked
• Troubleshoot Microsoft verification code issues
• My Microsoft account is blocked. - Microsoft Q&A
• Locked out of my Outlook account and recovery options not working - Microsoft Q&A
• I need to speak with a real person and it seems impossible. - Microsoft Q&A
• Need help with hacked microsoft account - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A