A tool for managing user identities, credentials, and access across on-premises and cloud environments
Because the passwords and recovery email addresses on both Microsoft accounts have been changed to ones not recognized, treat both accounts as fully compromised and use the official recovery flows only.
Follow these steps for each affected account:
- Scan devices for malware before doing anything else
On each Windows 10/11 or 8.1 PC used with these accounts, run an up‑to‑date antivirus scan. If using Windows Security (Defender):- Open Start and search for Windows Defender / Windows Security.
- Run a Full scan and remove any threats found.
Do this before changing any passwords so new credentials are not stolen again.
- Use the hacked/compromised account troubleshooter
Go through the official guide for compromised Microsoft accounts. It will route to the correct self‑help or support options based on the sign‑in problem and the identifiers (email/phone) entered.
Use it for each of the two accounts. - Try normal password reset first
On the Microsoft sign‑in page for the compromised account:- Select Forgot my password.
- Choose I think someone else is using my Microsoft account when prompted.
If any of the verification options shown are still owned (old email, phone, Authenticator), use them to reset the password and then immediately review security settings (step 5). If all options are attacker‑controlled, continue with the recovery form.
- Submit the Microsoft account recovery form
If sign‑in and standard reset both fail because the attacker replaced all security info:- Use the Account recovery form from a device and location previously used with that account (home/office PC, usual browser).
- Provide a different, working contact email that can receive messages; this is only used to communicate about the recovery request.
- Fill in as many accurate details as possible (old passwords, subject lines of recent emails, contacts, Xbox/Microsoft Store usage, etc.).
Microsoft reviews the form and responds within about 24 hours. If the result is negative, it is possible to try again with more complete/accurate information, ideally from an InPrivate/Incognito window and a different device/network as suggested in the Q&A references.
- If access is regained, secure the account immediately
For each recovered account:- Change the password to a new, strong one that is not reused elsewhere.
- On the Security basics / Advanced security options pages, review:
- Security info (email addresses, phone numbers, Authenticator) and remove any not recognized.
- Sign‑in aliases and remove any attacker‑added aliases.
- Add at least one additional, trusted way to sign in or verify (extra email, phone, or Microsoft Authenticator) so future recovery is easier.
- Review Outlook settings such as connected accounts, forwarding, and automatic replies to remove any malicious rules or forwarding the attacker set up.
- If the recovery form fails repeatedly
If the account recovery form is unsuccessful and all security info has been replaced, there is no other supported method to regain access to those specific Microsoft accounts; support agents cannot bypass the automated ownership checks or manually reset passwords in that situation, as reflected in the Q&A references. - Protect other accounts and devices
- Change passwords on any other services where the same or similar password was used.
- Enable multi‑factor authentication wherever available.
- Avoid staying signed in on shared/public devices and sign out of Microsoft accounts in browsers when finished.
References:
- How to recover a hacked or compromised Microsoft account
- What happens if there's an unusual sign-in to your account
- Help with the Microsoft account recovery form
- Hello , welcome to Account help & learning
- How to help keep your Microsoft account secure
- Microsoft account has been locked
- My account got hacked - Microsoft Q&A
- My account got hacked. - Microsoft Q&A
- my microsoft account has been compromised - Microsoft Q&A
- How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
- Need help with hacked microsoft account - Microsoft Q&A