Managing personal Outlook.com account settings, security, and privacy
Use the Microsoft account sign-in helper first. It asks for the account email address or phone number and either provides self-help steps or offers the chance to talk to an agent.
Recommended recovery path:
- Scan the PC for malware before changing anything
- Open Virus and threat protection.
- Select Scan options > Full scan > Scan now.
- This matters because the account was compromised through a fake verification flow, and Microsoft recommends a full scan before changing the password.
- Try to sign in and change the password
- If sign-in still works, change the password immediately and use a strong password.
- If sign-in does not work, use the password reset flow.
- If the sign-in alias, password, or security info was changed, submit the Microsoft account recovery form
- Fill in as much information as possible.
- Recovery results are sent to the working email address entered in the form within 24 hours.
- If Microsoft cannot verify the account, the form can be retried up to two times per day.
- After regaining access, review account settings changed by the attacker
- Check connected accounts.
- Check forwarding.
- Check automatic replies.
- If direct help is needed, use the support contact flow from another accessible Microsoft account
- In Microsoft Support, enter the problem and select Get Help.
- If needed, select Contact Support.
- Support can guide the process, but Microsoft states support agents cannot send password reset links or directly change account details.
Important limits from Microsoft:
- Microsoft support agents and advocates are not allowed to send password reset links or access and change account details.
- If the attacker changed the sign-in alias and security information, recovery depends on successfully proving ownership through the official recovery process.
- If unrequested verification codes arrive again, do not respond to them.
If the account is a work or school account, use the separate work/school password help path instead of the personal Microsoft account flow.