A Microsoft app for iOS and Android devices that enables authentication with two-factor verification, phone sign-in, and code generation
If the account was compromised using a verification code, take these steps immediately:
- Run a full malware or antivirus scan on the PC before changing anything. Microsoft recommends clearing viruses or malware first.
- Try the Microsoft account recovery flow for compromised accounts using the sign-in helper tool: Start
- If access is still possible, go to the Security basics page:
- Select Review activity and check for unusual sign-in attempts.
- If suspicious activity appears, select This wasn't me or Secure your account where available.
- Select Change password and set a strong new password.
- After regaining access, review account settings that may have been changed, including connected accounts, forwarding, and automatic replies.
- Do not respond to any verification codes that were not requested.
Important limits:
- Microsoft support agents are not allowed to send verification codes, send password reset links, or access and change account details.
- If the attacker already changed the security information or turned on their own two-step verification, self-service recovery may no longer work.
- If verification messages are not arriving because the account is locked or flagged for unusual activity, that issue must be resolved first.
If sign-in is blocked because of unusual activity, follow the sign-in screen prompts to receive a security code and unlock the account. If traveling or on a new device, signing in from a trusted device or usual location can help.
If verification codes are not arriving, try another listed method on the Security basics page, or choose I don't have any of these to replace security info. If the alternate email is another Microsoft account, use two privacy-mode browser windows so both accounts stay signed in while retrieving the code.
If recovery still fails, use the sign-in helper or Contact Support for technical guidance, but account ownership and security details cannot be changed by support.
References: