Use the Microsoft account recovery flow with the original email address for the account, even if a hacker changed the current sign-in email.
- Start with the sign-in helper for hacked accounts: Start
- This tool asks for the email address or phone number and either shows self-help steps or offers the chance to talk to an agent.
- If access is still blocked, use the Microsoft account recovery form.
- If the account was created with the original email, enter that original address as the account to recover.
- Provide a working contact email that can receive updates about the recovery request.
- Add as much detail as possible. Helpful details include:
- old passwords
- Outlook.com or Hotmail.com contacts and exact email subject lines
- Skype ID, contacts, or recent Skype purchase details
- Xbox console hardware ID from a console used frequently
- other Microsoft services used with the account
- Microsoft reviews the answers and responds to the contact email within 24 hours.
- If the request is not verified, the form can be retried up to two times per day.
- Important limitation:
- If two-step verification was turned on and none of the alternate verification methods are accessible, support agents cannot send password reset links or change account details.
- If the account is recovered, immediately secure it:
- Run a full malware scan on the PC first.
- Then change or reset the password.
- Review account settings such as connected accounts, forwarding, and automatic replies, because these may have been changed during the compromise.
- If unusual sign-in alerts were received and sign-in is still possible on any session, go to the Security basics page, review recent activity, report anything unrecognized, and change the password.
References: