Someone stole my son's email account and we cannot access it any more

Use the official recovery flow immediately:

1. Start the Microsoft Sign-in helper. It asks for the email address or phone number and either provides self-help steps or offers the chance to talk to an agent.
2. Before changing any password, run a full malware scan on the PC:
   • Open Windows Security
   • Go to Virus and threat protection
   • Select Scan options > Full scan > Scan now
3. If sign-in is still possible anywhere, change the password from the account security flow. If sign-in is no longer possible, use the password reset/recovery flow.
4. If access is restored, review account settings that attackers commonly change:
   • connected accounts
   • forwarding
   • automatic replies
5. If Microsoft reports unusual sign-in activity, go to the Security basics page, open Review activity, and mark suspicious activity as This wasn't me or Secure your account.

If the account is blocked because of unusual sign-in activity, use the Outlook.com unblock flow through the Sign-in Helper.

If recovery and unblocking both fail, use Microsoft support contact options from the sign-in and recovery pages. Support agents are not allowed to send password reset links or directly change account details, but the official support path is the next step.

• How to recover a hacked or compromised Microsoft account
• What happens if there's an unusual sign-in to your account
• Unblock my Outlook.com account
• My username and password have stopped working