A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
For a hacked Microsoft account, it is not possible to directly retrieve personal details of the attacker. What can be done is secure the account, review activity, and report the incident.
- Review recent activity on the Microsoft account
- Go to the Security basics page.
- Select Review activity to open the Recent activity page.
- Check for unusual sign-ins or device registrations.
- For any activity that was not done by you:
- In the Unusual activity section, expand the event and select This wasn’t me.
- In the Recent activity section, expand the event and select Secure your account.
- Secure the account immediately
- From the Security basics page, select Change password and set a strong, unique password.
- Ensure security info (alternate email, phone) is up to date so alerts and recovery codes reach only trusted contacts.
- Use the hacked/compromised account recovery flow if access is lost
- Follow the official guide for recovering a hacked Microsoft account and complete the account recovery form with as much accurate information as possible (past passwords, contacts, subject lines, etc.).
- If security info has been replaced and the recovery form fails, the account may not be recoverable.
- Report the identity theft and technical support scam
If there is blackmail, extortion, or suspected identity theft:- File a police report and keep a copy.
- Report suspicious or fraudulent incidents to Microsoft via the Report Abuse or Microsoft – Report a technical support scam page.
- If Defender identity theft monitoring is set up, contact the restoration support number in the app for help from Experian’s identity theft specialists.
- Secure devices and contain damage
Since the phone appears to have been wiped or disabled:- Run full antivirus/malware scans on any PCs or other devices used with the account.
- Consider a factory reset of compromised devices once data is backed up or assessed by the manufacturer.
- Inform contacts (from another account or device) that the account was compromised so they can ignore suspicious emails.
While it is understandable to want the attacker’s identity, Microsoft’s systems and consumer tools do not expose personal details of other users. Focus instead on securing the account, documenting the incident, and working with law enforcement and official support channels.
References:
- What happens if there's an unusual sign-in to your account
- Microsoft account has been locked
- Protecting yourself from identity theft online
- Hello , welcome to Account help & learning
- My account got hacked - Microsoft Q&A
- My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
- Need help with hacked microsoft account - Microsoft Q&A
- How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
- Hacker set up continuous draft ransomware email - Microsoft Q&A