Use the Microsoft Sign-in Helper first. It is the primary recovery path for a hacked Microsoft account and can either guide through self-help steps or offer the chance to talk to an agent.
Recommended order:
- Run a full malware scan on the PC first
- Open Virus and threat protection.
- Select Scan options > Full scan > Scan now.
- This is important before changing any password, so the attacker does not immediately capture the new one again.
- Try the Sign-in Helper tool
- Enter the Microsoft account email address or phone number that was used to sign in.
- If the account issue is detected, the tool will tell what action to take next.
- If no issue is detected, it will guide through additional self-help steps.
- If the password no longer works, use account recovery
- On the recovery flow, enter the email address, phone number, or Skype name used to sign in.
- Double-check the email domain and spelling.
- If the original email is not recognized, try any other alias or phone number previously added to the account.
- Choose where to receive the security code, enter the code, and set a new password.
- If the recovery form is needed, complete it carefully
- Microsoft recommends trying the Sign-in Helper before the recovery form.
- Recovery form results are sent to the working email address provided in the form, usually within 24 hours.
- If verification fails, the form can be retried up to two times per day.
- If security info was changed and a pending-change message appears
- If the message says “Your security info change is still pending” or “You can't access this site right now”, the account security info was replaced and there is a 30-day wait before the changes take effect.
- After access is restored
- Change the password immediately.
- Review account settings such as connected accounts, forwarding, and automatic replies, because these may have been changed after the compromise.
Important limits:
- Support agents are not allowed to send password reset links or directly change account details.
- If two-step verification was turned on and there is no access to any alternate verification method, Microsoft states that support cannot help recover the account.
- The Microsoft 365 Basic subscription receipt may be useful as proof of ownership when discussing the case with support, but account recovery still follows Microsoft’s verification process.
- How to recover a hacked or compromised Microsoft account | Microsoft Support
- I can't sign in to my Microsoft account | Microsoft Support
- My username and password have stopped working | Microsoft Support
- Help with the Microsoft account recovery form | Microsoft Support
- Help with the Microsoft account recovery form | Microsoft Support
- What does “Security info change is still pending” mean? | Microsoft Support