Managing personal Outlook.com account settings, security, and privacy
Because the email address and security info on the Microsoft account have already been changed to the attacker’s email, recovery options are very limited. Only the official Microsoft recovery and security flows can be used; support cannot override them manually.
Follow these steps in order:
- Use the hacked/compromised account guide
Go through the official guidance for compromised Microsoft accounts here:
- How to recover a hacked or compromised Microsoft account This will walk through scanning devices for malware, changing passwords (if still possible), and checking account settings.
- Submit the account recovery form with every detail remembered
If sign-in is no longer possible because the alias and security info were changed, use the account recovery form linked from the article above (for example via the Sign-in Helper or “Forgot my password” → “I think someone else is using my Microsoft account”). When filling the form, include as much accurate information as possible, such as:
- Old passwords
- Exact subject lines of emails recently sent or received (from memory)
- Approximate dates of account creation or major purchases
- Any billing details remembered (card type, last digits, etc.)
- Xbox-related info if remembered later (gamertag, subscriptions), but it is not mandatory if unknown.
- Use the Sign-in Helper and support options
- Start from the Sign-in Helper: Open the Sign-in Helper for support options or hacked account issues.
- Follow the prompts; in many cases this leads back to the recovery form. If offered, use the option to contact support (chat) and choose categories like “Other products” → “Manage account security” so an agent can confirm what options remain. They still cannot restore the account without the recovery checks passing.
- Protect other accounts and devices
Since the email was hacked, assume other services might be at risk:
- Run a full antivirus/malware scan on all PCs and devices used to sign in, as described in Step 1 of the hacked-account article.
- Change passwords on other important accounts (email, banking, social media) that used the same or similar password.
- Add extra verification methods (phone, authenticator app, passkeys) to remaining accounts to avoid a similar takeover. See the guidance on adding another way to sign in: How to help keep your Microsoft account secure.
- If recovery ultimately fails
The Q&A references explain that when an attacker has replaced all security info and the recovery form cannot be passed with sufficient correct data, the account is treated as unrecoverable, even if emails showing the change are available. In that case:
- Create a new Microsoft account.
- Secure it immediately with strong, unique passwords and multiple sign-in methods.
- Update this new account everywhere it is used (Windows sign-in, Xbox, apps, etc.).
There is no separate manual proof process beyond the official recovery form and tools; emails showing the change help only insofar as they let the correct account and timing be remembered when filling the form.
References:
- How to recover a hacked or compromised Microsoft account
- Hello , welcome to Account help & learning
- How to help keep your Microsoft account secure
- Unblock my Outlook.com account
- My account got hacked. - Microsoft Q&A
- My account got hacked - Microsoft Q&A
- Need help with hacked microsoft account - Microsoft Q&A
- How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A