Unauthorized charges on account

Hi @Theodore Eleftheriadis

This is a full account-takeover scenario because the attacker changed the primary alias, replaced the security information, and enabled two-factor authentication.

Please do not post your full email address, screenshots containing personal information, payment details, recovery codes, or any other proof of identity publicly here.

The first thing I would check is whether you still have the account signed in on any device, browser, Outlook app, Xbox, or phone. If you do, do not sign out yet. That existing session may still be useful for recovery.

Next, use Microsoft’s official Hacked or Compromised Account recovery flow and the Sign-in Helper. Microsoft specifically routes compromised-account cases through that process and may provide a path to support based on the information you enter.

If the attacker recently replaced all of your security information, Microsoft may place the account into a 30-day security-change pending period. If you can still reach the Security page and see a message such as “Your security info change is still pending,” look for the option indicating that you did not make the changes and follow that process immediately.

When completing any recovery form, use:

old passwords you remember

devices and networks previously used with the account

approximate account creation information

contacts and email subject lines

Microsoft services you used

purchase or subscription information where requested

If the original Hotmail alias is no longer recognized because the attacker removed it, still start from the official compromised-account recovery flow rather than creating another account or repeatedly attempting password resets.

Unfortunately, Microsoft Q&A contributors cannot manually restore aliases, disable the attacker’s 2FA, or access Microsoft’s internal account systems. Only Microsoft’s official recovery/support process can make account-level changes.

If this answer was helpful, please consider marking it as helpful or accepting it as the answer. It may help other users dealing with the same type of account takeover.