MS account stolen

Question

MS account stolen

R C 0

My son's MS account was stolen. Attackers managed to lure him into giving them the one-time password, after which they changed his password and appear to have set up MFA.

Trying to use his password is not working. Login window reports that account doesn't exist. Trying to recover the account by filling in the MS recovery form also says account doesn't exist. But trying to create a new account with that name reports that an account already exists and wants to send an authentication code to a phone, which is not something he had set up, so seemingly it would be the attackers' phone.

Any chance to recover somehow this account? The attackers are asking (via discord) to either pay, or help scam 2 other users.

.

[Moderator edit: Changed tags: Microsoft Security | Microsoft Identity Manager ]

0 comments

1 answer

Your answer

Answer 1

Hey there, R C

Sorry to read that your son's Microsoft account has been compromised and that he was tricked into providing his password for his account.

Normally when hackers compromise a Microsoft account, they change the Microsoft account alias (the username), which is why when you complete the Microsoft account recovery form it tells you that the Microsoft account no longer exists. This is because you must use the new email address they have changed it to.

They do this, because they know it makes it harder for you to recover the account. They also turn on two-factor authentication because they know Microsoft is unable to recover the Microsoft account once this has been enabled. This means the standard Microsoft account recovery form fails.

When you go and create a new Microsoft account, and reuse the email address your son once had, it will say that there is an account with this alias. This happens because once an account alias has been removed, it deletes it permanently and it cannot be associated with another Microsoft account again.

I am going to guess your son used his account for gaming. If so, please can you complete the Xbox account recovery form here: https://aka.ms/recovermyaccount

Please make sure you include as much information as possible so the Xbox account recovery team can help verify your account. The account team will email you back in 24 to 48 hours. Please email them back with any further comments as this will allow you to speak directly to the account recovery team.

In terms of the hackers asking for payment or help with making two other users fall for their scam. Please don't engage with this. I know it sounds tempting to try and get your account back, but the chances are they won't give you the account back once you have done what they have asked. Instead, it is likely they will move on and leave you with no account and a loss of money or another two victims. In addition to this, by participating and tricking others into falling for their scam, you are breaking the Microsoft service agreement which could lead to your other Microsoft account's been banned from the service if caught.

Hope this helps,
Nathan