Stop resubmitting the recovery form and use Microsoft’s compromised-account Sign-in Helper to request the available agent-contact option; because two-step verification was enabled and all verification methods were replaced, neither the form nor a support agent can manually bypass that protection. ^1^ ^2^
Remaining supported route
- Open Microsoft’s compromised-account page and run the Sign-in Helper.
- Enter the account’s original email address or phone number.
- Follow the offered self-help steps. If it offers contact with an agent, select that option. ^1^
- If no agent option appears, open Contact Microsoft Support, enter compromised Microsoft account, select Get Help, and then Contact Support. Use another Microsoft account if sign-in is required. ^3^
- Give the agent:
- The original sign-in address and Xbox Gamertag.
- Existing case numbers and the date of the unexplained case closure.
- A safe contact email that you currently control.
- The dates when the alias, password, phone number, 2FA, and security key changed.
- A request to confirm the correct contact address and whether any supported recovery path remains.
Do not expect screenshots, receipts, Discord links, or device history to let an agent manually return the account. Microsoft states that agents cannot send password-reset links or access and change account details. ^3^
The recovery form normally accepts account-specific information such as old passwords and the hardware ID of a frequently used Xbox console. However, Microsoft also states that when two-step verification is active and none of its verification methods are accessible, the form cannot recover the account. ^2^ That matches the condition described here, so submitting more copies with the same information is unlikely to change the result.
Secure everything else now
Before changing passwords, run Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends scanning first in case the device contributed to the compromise. ^1^
Then:
- Change the password of the contact email and every account that reused the Microsoft password.
- Sign out other sessions and review recovery addresses, forwarding rules, and connected applications on accounts still accessible.
- Contact the bank or payment provider if any unauthorized charge occurred.
- Preserve case emails, receipts, dates, and transaction records offline, but do not post them publicly.
- If recovery is impossible, create a new Microsoft account with a unique password, multiple recovery methods, two-step verification, and an offline copy of the recovery code.
Do not pay anyone claiming they can recover or “hack back” the account. Only Microsoft’s recovery systems can restore access, and forum users cannot inspect or modify account security information. A matching Microsoft Q&A case confirms that when an attacker has enabled 2FA and replaced every verification method, community moderators cannot disable it or escalate directly into account systems. ^4^
References
- How to recover a hacked or compromised Microsoft account | Microsoft Support
- Help with the Microsoft account recovery form
- How to help keep your Microsoft account secure | Microsoft Support
- My son's account Hacked - and because the hacker turned on two-step verification, Microsoft tells me there is nothing they can do! - Microsoft Q&A