If the Microsoft account email was changed by the attacker, the supported recovery path is still the Microsoft account recovery process.
- Use the Sign-in Helper first if the normal reset options do not recognize the account or the recovery email/phone options are unfamiliar.
- If that does not work, submit the Account recovery form again from:
- a device previously used to sign in to the account
- a location commonly used with that device, such as home or office
- Use a working email account in the form so the recovery result can be received.
- Before changing or resetting any password, run a full antivirus scan on the PC:
- Open Windows Security
- Open Virus and threat protection
- Select Scan options > Full scan > Scan now
- Recovery form results are sent to the working email address provided, usually within 24 hours.
- If recovery is denied, the form can be retried up to two times per day.
Important limits:
- Support agents are not allowed to send password reset links or access and change account details.
- If two-step verification was turned on and none of the alternate verification methods are accessible, the account cannot be recovered through support.
- If the message says "The Microsoft account you've entered does not exist", check the spelling carefully. If correct, use the sign-in help guidance.
If the account was hacked, also review account settings after access is restored, especially connected accounts, forwarding, and automatic replies.
References: