If two-step verification was turned on during the takeover and none of the verification methods are accessible, support agents cannot reset the password, send reset links, or change account details.
The supported next steps are:
- Use the Sign-in helper or Start tool for the hacked account flow.
- If the account recovery form is still available, submit it again from a device previously used to sign in and from a familiar location such as home. Include as much exact information as possible:
- old passwords
- Outlook.com contacts and exact email subject lines
- Skype ID or contacts
- Xbox console hardware ID from a console used frequently
- Check saved passwords in the browser or Windows credentials if old passwords might help complete the form.
- If the account was hacked, run a full malware scan on the PC before changing any passwords: Windows Security > Virus and threat protection > Scan options > Full scan > Scan now.
- If sign-in is restored, immediately change the password and review connected accounts, forwarding, and automatic replies because those settings may have been changed during the compromise.
- For technical support, use Contact Microsoft Support and select Get Help, then Contact Support. This can route to the best available support option, but account agents still cannot bypass account security controls.
Important limits from Microsoft:
- If two-step verification is on and alternate verification methods are unavailable, Microsoft states it cannot help recover the account through support.
- If support says the device ID is not accepted, there is no documented alternate manual override in the provided guidance.
- If the account cannot be signed into, the sign-in helper is the primary supported path.