Managing personal Outlook.com account settings, security, and privacy
For a hacked personal Microsoft account, the supported recovery path is the Sign-in Helper and, if needed, the account recovery form.
If the account is still accessible enough to start recovery:
- Start with the Sign-in Helper. It checks the account details provided and either shows the next self-help steps or may offer the chance to talk to an agent.
- Before changing the password, run a full malware scan on the PC:
- Open Windows Security
- Go to Virus and threat protection
- Select Scan options > Full scan > Scan now
- After the scan, change the password if sign-in still works, or reset the password if it does not.
- Then review account settings that are commonly changed after compromise, including connected accounts, forwarding, and automatic replies.
For the recovery form:
- Use a working email account that can receive messages about the recovery request.
- Complete the form from a device and location previously used to sign in, if possible.
- Microsoft states that support agents are not allowed to send password reset links or access and change account details.
Important limits called out by Microsoft:
- If two-step verification was turned on and none of the alternate verification methods are accessible, Microsoft states the account cannot be recovered through support.
- If a hacker changed key account data such as the sign-in email or recovery information, the available recovery options may be very limited.
If the recovery flow keeps looping, the next supported actions are:
- Retry through the Sign-in Helper first.
- If the username or email is no longer recognized, use Recover your account and follow the security code steps.
- If the account still cannot be found, use Contact support from the Microsoft support flow, but account recovery itself remains an automated process.
References: