Probable hacker

Sztupid Géjgő 0 Reputation points
2026-11-11T20:03:04.24+00:00

Hello, today my account got connected to some random apps, so I disconnected from them. I found out I can't get into the Activity tab and Security tab, because it doesnt accept my Authenticator code either. Then I found out an email has been attached to my account, namely a [Moderator note: PII removed]@netanyah.io account. I want to recover my account but it says that i cant recover it if I turned on 2 step verification, but I have it turned on and can't turn it off. What do I do?

Outlook | Web | Outlook.com | Account management, security, and privacy
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Lychee-Ng 30,735 Reputation points Microsoft External Staff Moderator
    2026-11-12T07:02:19.5066667+00:00

    I can see how alarming this is, Sztupid Géjgő.

    Please note that our forum is a public platform, and we will modify your question to hide private, identifiable information in the description. Kindly ensure that you hide such details the next time you post, even if it's not yours.

    The particularly frustrating part is that you have enabled two-step verification, which seemingly blocks the recovery path you're trying to take. If you're using the ASCR recovery form, the message you saw is consistent with how Microsoft’s recovery system works:

    User's image

    The only official route for compromised account is Microsoft's Sign-in Helper. It can identify your account issues and provide the appropriate self-help options. There's a chance it will offer you the Microsoft Account Recovery Form, which is particularly helpful if you use Xbox services, and since you know the takeover's address.

    User's image

    That said, unfortunately, with two-step verification on, your chances of recovering the account are low unless one of your own verification methods still works. I know how upsetting this is, especially when you're still trying to fix it, but I have to be realistic here so you can have correct expectations going forwards:

    • Microsoft Q&A is just a public user-to-user support forum. Contributors, including moderators and external staff, cannot access your account data to verify or restore it.
    • The recovery system is automatic and can only proceed to the next stage after account ownership is confirmed. No one can manually review your proof or change account information.
    • Even if you contact Microsoft Support, they cannot skip this process. Microsoft prohibits its customer service representatives from sending links to reset passwords or bypass verification.

    I know this isn't the answer you're hoping for, but I don't want to give you false hopes that someone can step in and unlock the account for you, because no one has that ability. If neither option gets you through, please be prepared for the possibility that this account can't be recovered.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-11T20:03:20.72+00:00

    This matches an account-compromise scenario where the attacker may have added their own security info and blocked normal verification.

    1. First, scan the PC for malware before changing anything:
      • Open Virus and threat protection.
      • Select Scan options > Full scan > Scan now. This is important because changing the password on an infected device can expose the new password again.
    2. Then use the hacked-account recovery flow:
      • Start the Microsoft hacked-account recovery process and use the sign-in helper tool.
      • Enter the account email address or phone number.
      • The tool will either show the available self-help recovery steps or offer the chance to talk to an agent.
    3. If access is still possible anywhere in the account, go to Security basics and select Review activity.
      • If suspicious sign-ins appear under Unusual activity, expand them and select This wasn't me.
      • If suspicious sign-ins appear under Recent activity, expand them and select Secure your account.
    4. If access is regained, immediately change the password from Security basics and create a strong new password.
    5. After recovery, check account settings that attackers commonly change:
      • connected accounts
      • forwarding
      • automatic replies
    6. If the account is temporarily blocked during verification or shows Try another verification method:
      • Try another verification method already connected to the account.
      • Try another network, such as switching between Wi‑Fi and cellular.
      • Wait 24 hours before trying again, and if needed wait longer, up to 1 week. Repeated attempts can reset the time lock.
    7. If unrequested verification codes are arriving, do not approve or respond to them. Without the code, the account remains protected.

    If the attacker already replaced the two-step verification methods, normal self-service recovery may no longer work. In that case, the hacked-account recovery process is still the correct path because it can present the available recovery options and may offer agent assistance.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.