- Start the Microsoft account recovery flow immediately with the sign-in helper tool. It asks for the email address or phone number and either shows self-help steps or offers the chance to talk to an agent.
- Before changing the password, scan the PC for malware:
- Open Windows Security
- Open Virus and threat protection
- Select Scan options > Full scan > Scan now
- If sign-in is still possible, change the Microsoft account password right away. If sign-in is no longer possible, use the password reset or account recovery options.
- After access is restored, review account settings that attackers commonly change:
- Connected accounts
- Forwarding
- Automatic replies
- Contact Microsoft Support through the official support flow if the helper tool does not resolve it. Support can route the case to the best available option, but support agents are not allowed to send password reset links or access and change account details.
- Do not pay the attacker.
- If the attacker changed the account alias, recovery email, or enabled their own two-factor authentication, community guidance in similar cases indicates the account is often no longer recoverable if the official recovery process is unsuccessful.
References:
- How to recover a hacked or compromised Microsoft account
- Microsoft account security info & verification codes
- My account got hacked - Microsoft Q&A
- My microsoft account was hacked, they changed the email, password, and turned on 2 factor authentication - Microsoft Q&A
- MIcrosoft account compromised, MInecraft account stolen, email alias changed. - Microsoft Q&A