Compromised Microsoft Account

The reported behavior is consistent with a compromised Microsoft account where the sign-in alias or security information was changed. The supported recovery path is limited to the official compromised-account and account-recovery flows.

1. First, secure the device used to access the account before changing anything else:
   • Open Windows Security.
   • Go to Virus and threat protection.
   • Select Scan options > Full scan > Scan now.
   • This should complete a full malware scan before any password or account changes.
2. Use the official hacked-account recovery process:
   • Start with the Microsoft sign-in helper for compromised accounts.
   • The tool asks for the email address or phone number and either shows self-help steps or offers the chance to talk to an agent.
3. If verification codes are not arriving or normal sign-in fails:
   • Avoid excessive or repetitive code requests, because that can trigger a temporary block on code delivery.
   • If access to security info is lost, select I don't have any of these at the Verify your identity prompt and follow the prompts.
   • If all security info is replaced successfully, there is a required 30-day wait before sign-in is allowed.
   • Do not change all security info at the same time unless necessary, because that can also restrict the account for 30 days.
4. If the account recovery form was already submitted:
   • Results are sent to the working contact email provided in the form within 24 hours.
   • If the account is not verified, the form can be retried up to two times per day.
5. If the account is temporarily blocked due to unusual activity:
   • Resetting the password is the documented way to unblock an Outlook.com account.
   • If that still fails, use the sign-in help path for accounts that cannot sign in.
6. If support becomes available:
   • Use Contact Microsoft Support, enter the problem, select Get Help, and then Contact Support.
   • Support can help route the case, but support agents are not allowed to send password reset links, verification codes, or directly access and change account details.

Important limitations from the documented process:

• If the original email now shows “we couldn’t find an account with that username”, check the spelling and domain carefully first.
• If the attacker changed sign-in details, the sign-in helper and recovery form remain the supported options.
• The documentation states that support agents cannot manually restore access by changing account details.

After access is restored, immediately review connected accounts, forwarding, and automatic replies, then update security methods and use a strong password.

• How to recover a hacked or compromised Microsoft account | Microsoft Support
• Help with the Microsoft account recovery form | Microsoft Support
• Troubleshoot Microsoft verification code issues | Microsoft Support
• Unblock my Outlook.com account | Microsoft Support