Submit Microsoft’s account-takeover recovery form at https://aka.ms/recovermyaccount; a successful submission generates an email containing an SIR case number, which is the case reference for this compromised-account investigation.^1^
Open the account-takeover case
- Open https://aka.ms/recovermyaccount from a device and location previously used with the account.
- Enter the original account information and a separate, working email address where Microsoft can contact you.
- In Alternate emails or phone numbers associated with the account, provide addresses and numbers that were previously attached to it.
- Include accurate ownership evidence where requested, such as:
- Previous passwords
- Earlier aliases or recovery details
- Xbox information
- Microsoft purchase or subscription details
- Submit the form.
- Check the alternate email’s Inbox, Spam, and Junk folders. The response should contain a case number beginning with SIR. If nothing arrives within four hours, submit the takeover form again.^1^
Do not publish the SIR number, old passwords, transaction details, or the attacker’s address on this public forum.
If the takeover form does not create a case
Use Microsoft’s official hacked-account page and start its sign-in helper. Enter the original email address or phone number; the tool provides applicable recovery options and may offer the opportunity to speak with an agent.^2^
Alternatively:
- Open Microsoft’s customer-support page.
- Select Personal account.
- Start the Microsoft account sign-in helper.
- If it cannot resolve the issue, use the offered support option, which may include chat.^3^
Since ordinary support has already sent you in circles, give the agent the SIR case number and state that this is an account takeover where both the sign-in email/alias and password were changed. That distinguishes it from an ordinary password-reset request.
Microsoft support agents cannot directly change personal-account details or send password-reset links; identity verification must go through the supported recovery process.^3^
After access is restored
Before changing the password, run Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends completing a full malware scan first. Then change the password and review connected accounts, forwarding, automatic replies, and security information.^2^
References