My son's account Hacked - and because the hacker turned on two-step verification, Microsoft tells me there is nothing they can do!

When you set up an account with Microsoft - or Google, Apple, Yahoo, etc.- the account provider will try to verify your identity, but there's a limit to how far that goes. You may be asked to respond to an email or a text message or provide a verification code, but nobody asks you to provide a government-issued ID.

Once your identity has been verified, you are now the owner of your account and your username, password and multifactor authentication ID, if requested, are recorded by the account provider.

On subsequent visits to the account, you'll enter your username, password and your verification code, and they will be accepted at face value, if correct, because they match the username, password and the verification code provided by someone whose identity was previously verified.

As the owner of your account, you are able to change your account password or your multifactor authentication information. You can also change your Microsoft account recovery code. You can do all these things without being challenged because you started out by entering the username, password and verification code of someone whose identity was previously verified.

Unfortunately, it's not unusual anymore for an account username and password to be stolen. This can happen in many ways, and the most common way - I'm not saying this happened in your case - is for the account owner to be tricked into giving them way. In fact, there is a saying in the cybersecurity community: Attackers don't hack their way in, they log in.

Once the account's username and password are in the hands of a thief, the thief can simply log in to the account, and they will be granted access because they have entered the username and password of someone whose identity has already been verified.

(If the account owner set up multifactor authentication with an authenticator app, the thief will be stopped because they don't have access to the account owner's phone.)

Microsoft obviously can't see who is sitting at the keyboard while typing in your username, password and verification code, nor is it Microsoft's responsibility to determine whether whomever is typing that username, password or verification code has authority to do so. As long as the username, password and verification code are correct, whoever types it can access the account.

Once inside the account, the thief is free to change the password, verification ID, recovery code and anything else about the account, with the result that the original owner is shut out of their own account. They are, in fact, no longer the owner.

It's not, as you seem to think, a simple matter to challenge a thief. Microsoft can't simply take away an account from someone who owns it. Microsoft is not a judge and jury, and they may have to face a judge and a jury if the thief decides to contest.

True as it may be that a thorough investigation could result in the account being returned to your son, Microsoft is not going to spend the time and money to conduct such an investigation because it isn't Microsoft's fault that the account was stolen in the first place, and literally thousands of Microsoft accounts are stolen every week.

What Microsoft can do - and does - is provide account holders with tools they can use to prevent their accounts from being stolen. Microsoft provides password-less authentication through Windows Hello, passkeys and multifactor authentication. Other account providers do the same. Account holders should also take advantage of advice and precautions widely available on the internet to help protect their accounts.

Finally, account holders have to be constantly aware of the many threats to their privacy and security from the internet. Each time they open their computers they are going up against professionals who operate with exceptional sophistication.

When a Microsoft account has been stolen, and the username, password and recovery information have all been changed, what you heard is true: the account cannot be recovered. There is nothing Microsoft can do to change that.

If you want to hear it, I can explain why the account can't be recovered, and why your evidence doesn't make a difference. But in the end, I'm sorry to tell you that the account is gone.