t account hacked – Recovery repeatedly rejected despite evidence, and no way to reach a human support agent

Question

t account hacked – Recovery repeatedly rejected despite evidence, and no way to reach a human support agent

Daniel Fiala 0

Microsoft account hacked – Recovery repeatedly rejected despite evidence, and no way to reach a human support agent

Hello Microsoft Community,

I'm writing here because we have exhausted all the official Microsoft account recovery and support options, and we are becoming increasingly frustrated with the complete lack of access to human assistance.

I'm helping someone whose personal email account was compromised on November 7, 2026.

The attacker gained access to the original email mailbox and apparently used it to compromise several other accounts, including Facebook and a Microsoft account.

We have successfully recovered and secured the original email account and Facebook account. Unfortunately, the Microsoft account remains under the attacker's control.

We have substantial evidence of the account takeover

After recovering the original email mailbox, we discovered multiple Microsoft security notifications from November 7, 2026, showing the sequence of unauthorized changes:

A Microsoft one-time verification code was requested.

The Microsoft account password was changed.

New security verification information was added.

Existing security verification information was removed.

Additional security information was subsequently added.

We also found a threatening email demanding a ransom, which further confirms that the original email mailbox had been compromised.

Most importantly, we have access to the original Microsoft security notification emails, including details of the unauthorized changes and the attacker's newly added recovery email address.

We can see the complete unauthorized recovery email address in the original Microsoft notification, while Microsoft's recovery interface displays a masked version of that same address.

We are willing to provide all of this evidence through an appropriate, secure channel.

The Microsoft account recovery process is a dead end

We have tried everything we could find:

The official Microsoft account recovery form, which has repeatedly rejected our requests due to insufficient information.

The password recovery process at aka.ms/pwr.

Microsoft telephone support, which is handled by an automated assistant that redirects us to aka.ms/pwr and ends the call.

Microsoft online support chat, accessed using another Microsoft account. Unfortunately, this also led to an AI assistant repeatedly directing us back to the same recovery form.

Every support option leads back to the same automated process that has already failed.

The Microsoft account is an old account that has not been actively used for years. We do not remember its previous passwords or other historical details required by the recovery form.

However, we do have the original email mailbox, the original Microsoft security notifications, the timeline of the attack, and evidence of the unauthorized changes.

I understand that Microsoft has strict account ownership verification requirements, and I fully support protecting users against unauthorized account recovery.

But what is the point of having all this evidence if there is no way to present it to anyone who can actually review the situation?

We are not even insisting on recovering the account

Our primary concern is security.

If Microsoft cannot restore the account, we would at least like to report the confirmed compromise and request that the account be investigated, restricted, or disabled to prevent further misuse.

We do not want an attacker to continue using a Microsoft account associated with the victim's identity.

My questions to Microsoft

Is there any legitimate way to reach a human Microsoft Account Security representative for a case like this?

Is there a secure channel for submitting evidence of an account takeover that the automated recovery form cannot accommodate?

If account recovery is impossible, can a compromised account be reported for investigation or suspension?

How is a legitimate account owner supposed to handle this situation when every support channel redirects them to the same unsuccessful automated recovery process?

We are not asking anyone to bypass Microsoft's security procedures.

We are asking for a way to report a documented account takeover and have the evidence considered, instead of being trapped in an endless loop of AI assistants and automated forms.

Any guidance from Microsoft staff or community members who have dealt with a similar situation would be greatly appreciated.

Thank you.

0 comments

2 answers

Your answer

Answer 1

I have now checked the original Microsoft security notification from November 7, 2026.

It explicitly states that the original recovery email address was removed from the Microsoft account. It does not say that removal is scheduled or pending.

The notification provides a "Review recent activity" button, but this leads to a sign-in process that we cannot complete because the attacker changed the password.

We also have notifications showing that the attacker added new security information.

Could someone from Microsoft please clarify whether the 30-day protection period actually applies in this situation, where the attacker apparently added a new verification method before removing the original one?

And if it does not apply, is there any official way to report this documented account takeover for security investigation without repeatedly submitting the unsuccessful recovery form?

Answer 2

Rob Koch 26,205 Volunteer Moderator

Did you read thorough the AI Answer and see the section regarding using the Sign-in Helper instead of the Recovery form?

"Since the recovery form has already been repeatedly attempted, do not simply resubmit the same information. Run Microsoft’s Sign-in Helper and enter the original account email address or phone number. It checks the account state and may present the applicable self-service action or an agent option."

Microsoft account sign-in helper | Microsoft Support

Note that it's possible the tool may offer an agent option that provides direct access to that channel rather than attempting to call directly, which is designed to fail, since if it were that easy to reach Support then the attackers would have the same easy method resulting in Microsoft Support becoming inundated with requests they can't typically use to verify identity, since that's not something that Microsoft accounts have never inherently contained.

The problem is actually obvious, but most people can't understand the true issues, since they don't understand that the typical 'proof' they hold is actually nothing more than account history, billing, or other similar information that the account itself contains, which the account thief now controls and of course has access to as well.

The deeper problem is that these thieves are professionals with complete technical knowledge of the Microsoft Personal account architecture, so unlike you they don't need to ask any of these questions and thus can act far more quickly to reverse anything you might try to do manually before you can use it to fully regain control.

Since you've indicated you don't really need the account, I'd concentrate on making direct contact via the Sign-in Helper tool, if possible, then be prepared to request that the Support you reach simply disable the account permanently, which is an appropriate request.

Often the Support reps can see that the account has been breached, but in order to protect them from being coerced or tricked by very well-prepared thieves or from often angry original account owners in various stages of grief over the loss of their accounts, Microsoft removed the capability for the agents to do anything other than provide explanations and aid in using the AI tools including the Recovery form that has taken their place.

The confusing part for consumers is they don't understand the simple truths I've laid out above and even though the Sign-in Helper tool page above tries to explain how to proceed, customers still seem to believe that the agents can do something they're not allowed to, specifically to avoid the human mistakes that often resulted in an account being lost.

The only thing that Support can actually do is to either block or disable the account, since that's the only manual recourse that's been left when they truly manage to determine that an account has been breached and is likely unrecoverable or in cases like yours where the recovery is less important than shutting down the ability for the thieves to abuse it further.

Rob

Daniel Fiala 0 Reputation points

2026-11-11T10:43:40.5733333+00:00

Hi Rob,

Thank you for your detailed explanation.

I have now followed your advice and gone through the Microsoft Account Sign-in Helper from start to finish.

Unfortunately, it leads to exactly the same dead end.

Here is what happened:

The Sign-in Helper reported "No problems found" with the account.

It directed me to the password reset process.

The only available verification methods belong to the attacker, including an unfamiliar recovery email address and apparently an authenticator app.

After selecting that I do not recognize these methods, I was redirected to the account recovery form.

That form has already rejected our requests multiple times.

At no point did the Sign-in Helper offer an option to speak with a support agent or submit a security incident report.

I have also tried telephone support and online chat using another Microsoft account. Both redirected me to the same automated recovery process.

I fully understand Microsoft's security restrictions and why support agents cannot simply reset an account based on someone's claims.

But there is still one question I would really appreciate your clarification on.

You mentioned that Microsoft Support can manually block or permanently disable a compromised account.

Is that something you know Microsoft Support can actually do for personal accounts, and if so, how can we request it?

We are no longer primarily interested in recovering this old account. We just want to prevent the attacker from continuing to use it.

We have the original security notification emails documenting the unauthorized changes, but no way to submit them for investigation.

I am not asking for a security bypass. I am simply looking for a way to report a compromised account without being sent through the same unsuccessful recovery process again.

Thank you for your help.
Rob Koch 26,205 Reputation points Volunteer Moderator

2026-11-11T20:59:30.26+00:00
I was hoping that the Sign-in Helper tool pathway would work for accessing the proper account support, since that's the most difficult issue when trying to regain control or simply have an account disabled,

Here's the manual version of this same method as provided in the AI Answer to another question that also mentioned it was collected from a previous account hacked (theft) instance that succeeded.

Escalate through Microsoft Support if the alias change prevents recovery

If the Sign-in Helper cannot locate the account or complete recovery:

Open Microsoft’s Contact Support option from the hacked-account page.

Enter Account Recovery or Account hacked or compromised.

Select Get Help → Contact Support.

Choose Other Products → Manage Account Security.

Select Chat with a support agent in your web browser, if offered.

Sign in with another accessible Microsoft account if required, and provide a safe contact email.

How to recover a hacked or compromised Microsoft account | Microsoft Support

Note that though the following actions section of the same answer post I found this likely doesn't apply in your case, the various detailed account information you mentioned in your first post above would be appropriate to replace it, since it's this history and other evidence of both account ownership and the attack sequence that will help Microsoft Support or possibly a separate account recovery team determine how to proceed in your case.

Unfortunately, I suspect the reason you're having so much trouble trying to access support is that if the Microsoft account itself wasn't regularly and recently used by the original owner, there may not have been any recent device links to the PC or other devices they'd used to access the account.

Microsoft always recommends trying to use both the recovery form and also the Sign-in Helper tool from a device recently used with the account, since that's something the Microsoft logging stores and can compare against to confirm account ownership. If the account hadn't been recently used, you can see the problem with this method, since the most recent user might likely have been the account thief instead, making your later attempts to both recover and access support appear to have less validity.

If your friend did actually use their account recently, try using the device they used for the Contact Support method above, since that's more likely to succeed regardless of what other information you might be asked to provide.

As a side note, since you never mentioned how the account breach might have occurred, have you checked the following page to see whether their account information had been found in a recent known breach?

https://haveibeenpwned.com

If so, then that's likely how the entire chain started and why as Microsoft recommends, only using 2FA and preferably a Passkey with Windows Hello Face (camera), Fingerprint, and/or PIN on your device if possible is currently the best way to keep this from happening in the first place, since all other common forms of authentication including passwords, TOTP codes and similar shared secrets are now easily phished from users, while the passkey used to support Windows Hello is encrypted in only usable from the device on which its stored.

Rob

t account hacked – Recovery repeatedly rejected despite evidence, and no way to reach a human support agent

Microsoft account hacked – Recovery repeatedly rejected despite evidence, and no way to reach a human support agent

We have substantial evidence of the account takeover

The Microsoft account recovery process is a dead end

We are not even insisting on recovering the account

My questions to Microsoft

2 answers

Escalate through Microsoft Support if the alias change prevents recovery

Your answer