Microsoft Account Compromised, Automatic Recovery Says 30 days whilst hacker with acces of my account can cancel it anytime.

The current security-information replacement must remain pending for 30 days; it cannot be accelerated, and Microsoft support cannot directly change the account, reset its password, or prevent someone controlling an existing verification method from cancelling the request.^1^^2^

Protect the pending request

Because you initiated the current replacement request, do not select Cancel this request, and do not report that particular request as unauthorized.

Distinguish between:

• The attacker’s earlier changes—removing your methods and adding their alias. Those were unauthorized.
• Your current pending replacement—the change that starts the 30-day wait. That is your request and should remain active.

The Let us know link on a pending-change screen is appropriate only if the pending change shown there was initiated by the attacker, not when it is your own recovery request.^3^

Microsoft documents that when all security information is inaccessible and replaced, sign-in is unavailable for 30 days. Using an existing security method during that period can cancel the update—which is why the attacker’s continued access presents a risk.^1^

Check for an existing signed-in session

If Outlook, Xbox, Microsoft Store, a browser, phone, or another PC is still signed in, do not sign out. Use that session immediately:

1. Open the Microsoft account security settings.
2. Under Manage how you sign in, remove only the attacker’s email alias if the page permits it.
3. Under Additional security options, remove verification methods you do not recognize and add a method you control, if permitted.
4. Change the password only after running a full malware scan on the device.
5. Check Outlook forwarding, connected accounts, and automatic replies for attacker-created settings.

Alias management and verification methods are separate settings; removing an alias does not necessarily remove a security-verification method. A closely matched account-takeover case recommends using any surviving authenticated session to remove the attacker’s alias and restore recovery information.^4^ Microsoft also recommends scanning the PC before changing the password and reviewing account settings after a compromise.^5^

If no signed-in session can reach those pages, leave the pending request active and monitor its destination email closely. Avoid repeated code or sign-in requests because excessive attempts can trigger temporary blocks.^1^

Contact support to report the active compromise

Since the automated recovery path has already returned you to the same 30-day process, contact support from a separate working Microsoft account:

1. Open Contact Microsoft Support.
2. Enter Compromised personal Microsoft account – attacker still has access.
3. Select Get Help, then Contact Support.
4. If category choices appear, select Other Products → Manage account security.
5. Choose browser chat or another offered contact option.

Ask the agent to record and route an active account takeover and explain that your own security-info replacement is pending while the attacker retains a valid method. This contact is not guaranteed to restore the account, shorten the wait, or stop cancellation. Microsoft states that support agents cannot send password-reset links or access and change account details.^2^

Do not post screenshots containing aliases, email addresses, recovery codes, order numbers, or other identifying details publicly. Provide them only if an official support agent supplies a secure submission channel.

References

1. Troubleshoot Microsoft verification code issues | Microsoft Support
2. How to help keep your Microsoft account secure | Microsoft Support
3. My account got hacked. - Microsoft Q&A
4. how to recover a microsoft account which was hacked, and the email was changed by the hacker. - Microsoft Q&A
5. How to recover a hacked or compromised Microsoft account | Microsoft Support