Microsoft 365 features that help users manage their subscriptions, account settings, and billing information.
Hi @Damian
I’m very sorry you’re dealing with this, especially after successfully proving ownership and regaining partial access to a 12-year-old account.
Resetting the password does not automatically remove the authenticator or other security information added by the attacker. Since the verification method shown is not yours, please use Microsoft’s Sign-in Helper and follow the compromised-account prompts. It may provide the appropriate recovery steps or an option to contact an agent.
If you can reach the account’s Security page, select Manage how I sign in and check whether the unfamiliar Authenticator method can be removed. Do not remove your only accessible verification method until you have added one that belongs to you.
Also check whether the account shows a pending security-information change. If you see an option such as Let us know or I didn’t make this change, select it immediately. Two-step verification cannot be cleared simply through another password reset, so repeatedly using the recovery form may continue producing the same result
Please note that this is a user-to-user support forum. Moderators and contributors cannot access accounts or Microsoft’s back-end systems. We can only provide technical guidance on reported incidents, requests and ideas
Thank you for your understanding