I have been hacked

Contact your bank or payment provider immediately to block further transactions, then secure the Microsoft account and report the unauthorized purchases to Microsoft Support.

1. Stop additional charges

• Tell the bank/card issuer that the payment method is compromised and ask it to block or replace it.
• Dispute each unauthorized transaction. Merely disputing existing charges may not prevent new ones, so explicitly report the card or payment information as compromised.^1^
• If possible, remove the affected payment method from your Microsoft account after recording the transaction details.

2. Secure the account

Use a trusted device—not one that may contain malware:

1. On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.
2. After the scan, change your Microsoft account password to a new, unique password. If you cannot sign in, use Microsoft’s compromised-account sign-in helper.
3. Check connected accounts, email forwarding, and automatic replies for changes you did not make.^2^
4. Review the account’s Recent activity. It shows sign-in activity from the previous 30 days. Expand suspicious entries and select This wasn’t me or Secure your account when offered.^3^
5. Review security information, remove unrecognized recovery methods or trusted devices, and enable Microsoft Authenticator or another strong sign-in method.^4^

Also change the password anywhere else that reused the same password.

3. Report the purchases and request a refund

1. Open your Microsoft account’s Manage your payments page and select Investigate beside an unrecognized charge.^1^
2. Check Order history and Services & subscriptions for unauthorized purchases or subscriptions. Cancel unauthorized subscriptions to prevent renewal.
3. Contact Microsoft Support, enter unauthorized purchases, select Get Help, and then select Contact Support.
4. Sign in with the affected account. If access is unavailable, use another Microsoft account to display the available support options. Billing agents must review private transaction details; community forums cannot issue the refund.^5^

Keep screenshots, order numbers, dates, amounts, bank statements, and Microsoft emails. Do not post those records—or any card number, email address, recovery code, or account identifier—in a public forum.

References

1. How to investigate a billing charge from Microsoft | Microsoft Support
2. How to recover a hacked or compromised Microsoft account | Microsoft Support
3. Check the recent sign-in activity for your Microsoft account
4. How to help keep your Microsoft account secure | Microsoft Support
5. I need to dispute charges in my Microsoft account on a day that I believe my account was hacked. - Microsoft Q&A