My son's email account has been compromised. Account recovery request was denied. What now?

Jesse Snyder 0 Reputation points
2026-08-17T22:24:45.45+00:00

The passwords to my sons email account have been changed by someone else. The secondary email associated with the account has also changed to an unrecognized address. We did not make those changes and I assume that his account has been compromised. We can no longer access his xbox profile, email, or any accounts associated with either.

We tried to recover the account and received this message:

*It looks like you just used the Microsoft account recovery form (https://account.live.com/acsr?mkt=en-US) to request a password reset for *****@outlook.com. Because you've turned on two-step verification for your account, we ignore these requests but wanted to let you know. If you're having trouble signing in, go to https://account.live.com/ResetPassword.aspx?mkt=en-US and reset your password using security info such as your phone, alternate email address, or authenticator app. For more info about two-step verification, visit http://go.microsoft.com/fwlink/?LinkId=276854. Thanks, The Microsoft account team Privacy Statement: https://go.microsoft.com/fwlink/?LinkId=521839 Microsoft Corporation, One Microsoft Way, Redmond, WA 98052

We did not change the password, the secondary email, or enable 2FA.... how can we get back into his account and stop unauthorized use?

Outlook | Web | Outlook.com | Account management, security, and privacy
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-08-17T22:25:00.18+00:00

    If two-step verification is now enabled and none of the alternate verification methods are accessible, there is no direct reset path through support. Microsoft support agents are not allowed to send password reset links or access and change account details.

    The supported next steps are:

    1. Use the hacked account recovery flow first. The sign-in helper can guide to the correct self-help steps or offer the chance to talk to an agent: Start
    2. If the account recovery form was ignored because two-step verification is on, the recovery form will not bypass that protection. The official guidance states that if two-step verification is turned on and the alternate verification methods are unavailable, recovery cannot be completed through that form.
    3. If access is regained at any point, secure the device before changing the password:
      • Run a full antivirus scan.
      • In Windows Security, open Virus and threat protection.
      • Select Scan options > Full scan > Scan now.
    4. After the device is clean, change or reset the password and then review account settings such as connected accounts, forwarding, and automatic replies, because those settings may have been changed after the compromise.
    5. If the account recovery form is still needed for any further attempt, submit it from a familiar device and location, provide a working contact email, and include as much accurate account information as possible. Microsoft responds to recovery submissions within 24 hours, and unsuccessful verification can be retried up to two times per day.
    6. For additional assistance, use Microsoft Support contact options. Support can provide guidance, but cannot override account security protections or manually reset the account when verification requirements are not met: Contact Microsoft Support
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.