Urgent Assistance Required — Child’s Microsoft Account Compromised and Email/Recovery Information Changed

Question

Urgent Assistance Required — Child’s Microsoft Account Compromised and Email/Recovery Information Changed

R.S 0

My family uses Microsoft Family Safety, and my son's Microsoft account has been compromised.

The attacker changed the email address associated with his account to an email address belonging to another person and also changed the account's recovery email address. His original email address is no longer recognized as belonging to a Microsoft account.

I received no notification from Microsoft Family Safety regarding these changes. I discovered the compromise through our family account.

The compromised account still appears in our Microsoft Family Safety dashboard, but it now displays the changed account information.

I have attempted to follow Microsoft's account recovery procedures, but the standard recovery options do not address this situation. The original email address is no longer recognized, and the recovery email address has been replaced. Consequently, I cannot complete the usual recovery process using the information originally associated with my son's account.

As his parent and Family Safety organizer, I need assistance recovering his original account and restoring his legitimate account information.

I am requesting the following:

Assistance escalating this incident as a compromised minor's account, where the attacker has changed both the sign-in email address and the recovery email address.

Guidance on how to establish ownership of the account when the original sign-in information has been removed or replaced.

An explanation of whether the account's continued presence in our Family Safety dashboard can help Microsoft identify and investigate the compromised account.

Clarification regarding why no Family Safety notification was received when these account changes occurred.

I understand that Microsoft must protect account security and verify ownership. However, the normal recovery procedures appear insufficient for this specific situation because the attacker changed the very information those procedures rely upon.

Please advise how this incident can be escalated for review and what additional information I can provide to establish that this is my son's original account.

Thank you for your assistance.

0 comments

1 answer

Your answer

Answer 1

Hi R.S,

I'm very sorry to hear about what happened to your son's account.

Unfortunately, Microsoft Q&A is a public community forum. We do not have access to Microsoft account records, Family Safety data, or the ability to verify ownership, investigate account activity, or escalate account recovery requests on behalf of users.

Because this appears to be a compromised Microsoft account where the sign-in and recovery information may have been changed, we recommend using Microsoft's account recovery process: https://account.live.com/acsr

You may also find the following guidance helpful when completing the recovery form: https://support.microsoft.com/en-us/accounts-billing/manage/help-with-the-microsoft-account-recovery-form

When completing the recovery process, provide as much information as possible regarding the original account ownership, including the original email address, approximate account creation details, family relationship to the child account, and any information that may help establish ownership of the account.

Regarding the account still appearing in your Family Safety dashboard, community moderators do not have visibility into whether that information can be used internally during an account recovery investigation. Only Microsoft's account recovery team can review the account records and determine what information may be available for verification.

We understand how concerning this situation is, especially when a child's account is involved, and we hope the account recovery process can assist you further.

Best regards.