My account was recently compromised; I reported it to Microsoft and now they have locked my account

Lena Shedd 5 Reputation points
2026-05-25T15:47:24.5333333+00:00

My account was recently compromised; I reported it to Microsoft and now they have locked my account. I completed the account recovery form then I received several messages from CDOC Case Management cdoccm@microsoft.com They identified themselves by first name from Microsoft support. They ask for additional information to determine if I am the owner of the account. Needless to say, I did respond with some questions like last emails sent, subject lines, last 4 digits of cc used to purchase, etc... I am feeling uneasy about all of this after my experience. Are these legitimate questions they would ask? How can I talk to a live agent or chat with someone if I cannot log into my account? I also am subscribed with 360 for annual renewals automatically. How do I stop this if I cannot log into my account?

Microsoft 365 and Office | Subscription, account, billing | For home | Windows

1 answer

Sort by: Newest
  1. AI answer

    2026-05-25T15:47:39.2766667+00:00

    For a compromised or locked Microsoft account, Microsoft support can legitimately ask for detailed account history to verify ownership. Examples from official guidance include:

    • Subject lines of recent emails sent
    • Email addresses of frequent contacts
    • Partial payment details previously used on the account

    These are consistent with what is described for the account recovery process and are used to prove that the requester is the real owner, especially when normal sign-in and verification methods are not available.

    To proceed safely:

    1. Use only official Microsoft flows
      • Start from the official recovery and security guidance: How to recover a hacked or compromised Microsoft account and the built-in Start / sign-in helper links there.
      • If contacted by email, ensure that the conversation is clearly tied to a case you initiated via these official flows.
    2. Continue the recovery and verification steps
      • Follow the steps in the recovery article: scan devices for malware, then change/reset the password when access is restored, and review security settings (connected accounts, forwarding, automatic replies) as described in the guidance.
      • If the account is locked due to suspicious activity, follow the instructions in the lock/blocked-account flows (for example, using the sign-in helper and any aka.ms links shown on the lock screen).
    3. If sign-in and codes are blocked
    4. Getting to a live agent or chat without signing in
      • For consumer Microsoft accounts, direct phone or chat support is limited and most identity verification is automated. The context shows that:
        • The primary path is the automated recovery form and sign-in helper.
        • When those fail or error, users are directed to use the Microsoft Support portal and choose categories like “Other Products” → “Manage account security” to reach a chat agent (using another Microsoft account if necessary).
      • This is how other users with hacked/locked accounts are advised to escalate when self-service fails.
    5. Stopping Microsoft 365 subscription renewals
      • If the locked account is the one that owns the Microsoft 365 subscription, cancellation normally requires signing into that account.
      • If sign-in is not possible and recovery ultimately fails, the only supported route in the provided guidance is to continue working through the official recovery and support channels until either:
        • Access is restored and the subscription can be managed, or
        • Support confirms the account cannot be recovered.

    Because billing and subscription management are tied to the account identity, there is no separate, documented bypass in the context other than working through the official recovery and support processes.


    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.