My other account was hacked, they changed my email, and I am still being charged for gamepass without being able to cancel.

andrew mccully 20 Reputation points
2026-05-25T19:31:07.6366667+00:00

Over a month ago someone hacked my account. They added a passkey and changed my email so I haven't been able to access it. I just realized I've been charged for gamepass twice while having no access to my account. I tried to cancel and It would not allow me to without first signing in to the account. I tried emailing support but after copying the email it said the email didn't exist, and when I called they said they cannot help me over the phone. I really need to cancel gamepass and I am looking for solutions on how.

Outlook | Web | Outlook.com | Account management, security, and privacy
0 comments No comments

Answer accepted by question author
Darhyl Amizola 50,105 Reputation points Independent Advisor
2026-05-25T20:05:45.2133333+00:00

Hey there! Nice to meet you!

Please be advised that unless the account owner is able to access the account, subscription cancellation is not possible, and Microsoft personnel cannot retrieve this information.

Since it is no longer possible to recover your hacked account, you will need to reach out directly to your bank and request to freeze all charges from Microsoft, cancelling the subscription on its renewal in the process.

You may also need to request a new payment method.

Thank you for your understanding.

Best regards,

Darhyl

Was this answer helpful?

1 person found this answer helpful.
0 comments No comments

1 additional answer

Sort by: Most helpful
  1. AI answer

    2026-05-25T19:31:24.8+00:00

    To stop Game Pass charges on a hacked Microsoft account, the account itself must be recovered or formally treated as compromised; subscription cancellation cannot be done from outside the account.

    Follow these steps:

    1. Run through the official hacked-account recovery flow
      • Use the guided helper for hacked/compromised Microsoft accounts: How to recover a hacked or compromised Microsoft account.
      • Follow the steps in order:
        1. Scan devices for malware and secure them.
        2. Change or reset the password on the affected Microsoft account (if still possible).
        3. Check and correct account settings (forwarding, connected accounts, automatic replies) once access is restored.
    2. Use the account recovery form if locked out
      • If the hacker changed the email, password, or added their own sign-in methods so that sign-in is no longer possible, submit an account recovery request using the official recovery form referenced in the hacked-account article.
      • Provide as much accurate information as possible (old passwords, services used, etc.). If the form is denied, try again from a different device or network and an InPrivate/Incognito browser, as suggested in the Q&A guidance.
    3. If security info was changed, check for the 30‑day “security info change pending” state
      • If, when trying to sign in, a message appears like “Your security info change is still pending” or “You can’t access this site right now,” the attacker may have removed and replaced all security info.
      • In that case, the account is restricted for 30 days. During that period:
        • Use the built‑in options on that screen:
          • Cancel this request if the change was initiated and the old security info is still accessible.
          • Let us know if the change was not made by the account owner; this routes through the unauthorized-change flow.
      • Details are in: “What does ‘Security info change is still pending’ mean?”
    4. After regaining access, remove attacker methods and cancel Game Pass
      • Once back in the account:
        • Remove any attacker-added aliases or sign-in methods from the security settings.
        • Add secure verification methods (for example, Microsoft Authenticator) as described in the security info article linked from the context.
        • Go to the subscriptions area of the account and cancel Xbox Game Pass so future charges stop.
    5. If recovery fails and security info is fully replaced
      • If the recovery form repeatedly fails and all security info has been replaced by the hacker, the Q&A guidance indicates there may be no further method to regain that personal Microsoft account, and Support cannot override the automated process.
      • In that situation, contact the payment provider (bank, card issuer, or PayPal) to dispute or block future charges, since cancellation from within the account is not possible.
    6. Use official support channels instead of email
      • For personal Microsoft accounts, there is no direct email address for hacked-account handling. Use:
      • If additional help is needed after using the automated tools, use the Contact Support flow described in the Q&A (via the Microsoft Support site → “Other Products” → “Manage account security” → chat with a support agent in the browser) and explain that the account is compromised and still being billed.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.