Use the official account recovery path immediately:
- Run a full malware scan on the PC first, before changing anything.
- Open Virus and threat protection
- Select Scan options > Full scan > Scan now
- Start with the Microsoft Sign-in Helper tool. It can guide to the correct recovery option and may offer self-help or the chance to talk to an agent.
- If sign-in still fails, try the standard recovery flow:
- Select Recover your account
- Enter the email address, phone number, or Skype name used to sign in
- If the address is not recognized, check the domain carefully and try any other alias or phone number that was on the account
- Choose where to receive the security code
- Enter the code, then set a new password if verification succeeds
- If the recovery options now show an unfamiliar address such as the bibimail.net address, use the Microsoft account recovery form and provide as much accurate information as possible. Microsoft reviews the answers and sends the result to the working email address provided in the form within 24 hours.
- If verification fails, the form can be retried up to two times per day.
- If the account is recovered, immediately review account settings that attackers often change:
- connected accounts
- forwarding
- automatic replies
- After recovery, strengthen the account:
- Add another way to sign in or verify identity in Advanced security options
- Consider Microsoft Authenticator or going passwordless
Important limits from Microsoft support:
- Support agents are not allowed to send password reset links or access and change account details.
- If two-step verification was turned on and none of the alternate verification methods are accessible, support cannot bypass that.