Accessing hacked account with two step verification disabled

Question

Accessing hacked account with two step verification disabled

Mornington 20

Hi,

I have a subscription e-mail that I’ve been unable to access for two months because something disabled my phone number for a month and in that month my SIM card was stolen. I still pay my subscription and have tried emailing Microsoft as I made around 30 attempts when the SIM card was still available.

how do I access the 30 day account recovery after this targeted attack. Obviously I have my secondary email and bank details and records to prove the account is mine and I am concerned my private data is being accessed which includes important documents and data.

thanks

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello @Mornington

I'm sorry you're dealing with this. If you suspect your Microsoft account was compromised and you no longer have access to the phone number used for verification, there are a few important distinctions about the 30-day recovery/security-info process.

Microsoft Support can't manually activate or bypass the 30-day period. It normally applies when you replace all existing security information. Microsoft places the account into a restricted state for 30 days before the replacement security information becomes effective.

If you see “Your security info change is still pending” and you didn't initiate the change, Microsoft provides a “let us know” option on that screen to report that someone else made the security change. I would use that rather than simply waiting if you believe an attacker initiated it.

If you're unable to reach that screen, start with Microsoft's account recovery/sign-in process:

Microsoft — Recover a hacked or compromised account

Microsoft — Account recovery form guidance

Since you still have access to your secondary email and information that may establish account ownership, provide as much accurate information as possible during recovery. Microsoft recommends submitting the recovery request from a device and location previously used to access the account, if possible. For Outlook accounts, details such as previous passwords, contacts, and exact email subject lines can also help with verification.

One important limitation: if two-step verification was enabled and you have lost access to all configured verification methods, Microsoft's documentation states that support agents cannot manually bypass two-step verification, send a password-reset link, or change the account's security information.

Because you mentioned a stolen SIM and possible unauthorized access, I would also contact your mobile provider immediately to secure the phone number/SIM if you haven't already. Once you regain access to the Microsoft account, change the password, review security information and recent account activity, remove anything you don't recognize, and configure Microsoft Authenticator/passkeys plus additional recovery methods.

Also, please don't post your bank details, phone number, recovery codes, passwords, or other private account information in this public forum. Those details won't allow community members to recover the account and could expose you to further compromise.

Please "Accept the Answer" if this information helped you. This will help us and others in the community.

Mornington 20 Reputation points

2026-08-20T12:35:53.4433333+00:00

Thank you, does this mean that Microsoft recently changed it’s security system, as I have had this issue before without needing access to compromised security information.

if so, does that mean Microsoft is no longer a safe space to store personal information, such as memories of people who have passed away and historical records.