Use the official hacked-account recovery flow immediately:
- Start the Microsoft sign-in helper for hacked accounts: Start. It asks for the account email address or phone number and then shows self-help steps or offers the chance to talk to an agent.
- Before changing any password, run a full malware scan on the PC:
- Open Windows Security
- Go to Virus and threat protection
- Select Scan options > Full scan > Scan now
- After the scan, try to change or reset the password:
- If sign-in still works, change the password.
- If sign-in does not work, use the password reset flow.
- If access is restored, review account settings that attackers often change:
- connected accounts
- forwarding
- automatic replies
- Check the account’s Recent activity from the Security basics page. If suspicious sign-ins appear, mark them as This wasn't me or Secure your account.
- Add another way to sign in or verify identity in Advanced security options so recovery is easier next time.
Important limits:
- Support agents and advocates are not allowed to send password reset links or access and change account details.
- If the account recovery form is needed, the result is sent to the working email address provided, usually within 24 hours.
- If Microsoft cannot verify ownership, the form can be retried up to two times per day.
If the account is now blocked because of unusual sign-in activity, use the Sign-in Helper here: Sign-in Helper.