I've been phished and can't log back into Outlook nor contact customer support

Treat this as a compromised personal Microsoft account: stop entering credentials into the suspicious Outlook prompt, secure the device, and then use Microsoft’s Sign-in Helper from a trusted browser or device.

1. Secure the device before resetting the password

First determine where the false prompt appears:

• Only on a web page: Close the page without entering anything. Open a new browser window on a trusted device and manually navigate to Microsoft Support.
• Inside Outlook for Windows or elsewhere on a Windows 10/11 PC: Disconnect that PC from the network temporarily and scan it before changing the password:
  1. Open Windows Security.
  2. Select Virus & threat protection.
  3. Select Scan options → Full scan → Scan now.
  4. If the prompt or malware returns, save open work and run Microsoft Defender Antivirus (offline scan) from the same page. The PC will restart, scan outside Windows, and restart again. Review the result under Protection history.^1^
• On macOS, iPhone, Android, or another platform: Do not use the Windows instructions. Update the operating system and security software, scan with the platform’s current security tools, or perform recovery from a different trusted device.

Microsoft specifically recommends completing a malware scan before changing a compromised account’s password.^2^

2. Recover the personal account

From a trusted device:

1. Open Microsoft’s hacked-account page and select its Sign-in Helper.
2. Enter the Outlook.com email address or associated phone number.
3. Follow the offered recovery or password-reset option.
4. If directed to the account recovery form, provide as much accurate historical information as possible, such as previous passwords, recent email subjects, contacts, and Microsoft services used.

The Sign-in Helper checks the account and either displays the applicable self-service recovery steps or offers an opportunity to contact an agent.^2^

Do not return to the route that identifies the account as organizational. An Outlook.com, Hotmail.com, or Live.com address created personally is normally a personal Microsoft account; use the Personal account tab on Microsoft’s support page instead.

3. Request chat or a telephone callback

Microsoft’s personal-account support page provides the supported contact route:

1. Open Contact Microsoft customer support.
2. Select Personal account.
3. Start the Sign-in Helper or select Get help.
4. Describe the issue as: “Personal Outlook.com account compromised by phishing; cannot sign in.”
5. If self-service does not resolve it, select Contact Support.
6. Choose either:
   • Chat with a support agent in your web browser, or
   • Provide your phone number and a support agent will call you.

Contact methods vary by product, scenario, subscription, region, and operating hours.^3^^4^

Support can explain the recovery process, but agents cannot send a password-reset link or directly access and change account details. Ownership must be established through Microsoft’s recovery mechanisms.^4^

4. After access is restored

Immediately:

• Change the password to a unique password not used elsewhere.
• Check Outlook connected accounts, forwarding, and automatic replies for unauthorized changes.^2^
• Review recent sign-in activity.
• Remove unfamiliar recovery addresses, phone numbers, devices, or sessions.
• Add an alternate email address and mobile number for recovery.^5^
• Enable Microsoft Authenticator or another additional sign-in method.

Also change passwords for any other accounts where the same password was reused, starting with the recovery email and financial accounts.

References

1. Virus and Threat Protection in the Windows Security App | Microsoft Support
2. How to recover a hacked or compromised Microsoft account | Microsoft Support
3. Get Help for Microsoft personal account users | Microsoft Support
4. Contact Microsoft customer support | Microsoft Support
5. Help protect your Outlook.com email account | Microsoft Support