Account been hacked

Because the attacker changed the recovery information and the first recovery request was denied, use Microsoft’s Sign-in Helper, then submit a better-evidenced recovery form from a familiar device and location; Microsoft permits up to two recovery attempts per day.^1^

1. Use the Sign-in Helper for the altered security details

Open the Microsoft account Sign-in Helper and enter the original Outlook/Microsoft email address or phone number.

The tool checks the account details and provides the available recovery route. If it does not recognize the account, try any other email alias, phone number, or Skype name that was previously attached to it.^2^

Microsoft’s compromised-account page says the helper can provide self-service instructions or, when available for the case, an opportunity to speak with an agent.^3^

2. Resubmit the recovery form with stronger historical evidence

Since the previous submission was denied, do not simply send the same answers again. Microsoft allows repeated submissions, limited to two per day.^1^

For the next submission:

1. Use a computer, phone, or Xbox previously used with the account.
2. Submit it from a familiar location and network, such as home.
3. Provide a separate working email address where Microsoft can contact you.
4. Gather and enter as much historical information as possible:
   • Exact subject lines of Outlook messages.
   • Names or addresses of contacts you emailed.
   • Older passwords used on the account.
   • The hardware ID of an Xbox console used frequently—preferably the older console if you recently replaced it.
   • Skype ID, contacts, and purchase details, if applicable.
   • Details matching what was entered when the account was originally created, even if your name or address later changed.
5. Use the information that existed before the compromise, not the replacement phone number or email added by the attacker.

Microsoft states that guessing is acceptable when uncertain and that wrong answers do not count against you; complete every “add more” section you can. Results are sent to the working contact address, normally within 24 hours.^4^

Important recovery limits

• Support agents cannot manually send a password-reset link or directly change the account details. Ownership must be established through Microsoft’s recovery and verification systems.^4^
• If you had enabled two-step verification before the compromise and have lost every configured verification method, Microsoft states that the recovery form cannot override that protection.
• If two-step verification was not enabled and none of the displayed phone numbers or email addresses are yours, return to the Sign-in Helper rather than trying to verify through the attacker’s details.^4^
• No one on this public forum can inspect or restore the account. Do not post receipts, old passwords, email addresses, verification codes, or other private ownership evidence here.

Secure the devices before another password change

Because changing the password did not keep the attacker out, scan every Windows PC used with this account before changing it again:

1. Open Windows Security.
2. Select Virus & threat protection.
3. Select Scan options → Full scan → Scan now.
4. Update and scan other devices that accessed the account.

Microsoft specifically recommends completing a full malware scan before changing a compromised account’s password.^3^

If access is restored, immediately review security information and Outlook’s connected accounts, forwarding, and automatic replies, then add a verification method or Microsoft Authenticator.^5^

References

1. Account recovery unsuccessful | Microsoft Support
2. Microsoft account sign-in helper | Microsoft Support
3. How to recover a hacked or compromised Microsoft account | Microsoft Support
4. Help with the Microsoft account recovery form | Microsoft Support
5. How to help keep your Microsoft account secure | Microsoft Support