t account hacked – Recovery repeatedly rejected despite evidence, and no way to reach a human support agent

Question

t account hacked – Recovery repeatedly rejected despite evidence, and no way to reach a human support agent

Daniel Fiala 0

Microsoft account hacked – Recovery repeatedly rejected despite evidence, and no way to reach a human support agent

Hello Microsoft Community,

I'm writing here because we have exhausted all the official Microsoft account recovery and support options, and we are becoming increasingly frustrated with the complete lack of access to human assistance.

I'm helping someone whose personal email account was compromised on November 7, 2026.

The attacker gained access to the original email mailbox and apparently used it to compromise several other accounts, including Facebook and a Microsoft account.

We have successfully recovered and secured the original email account and Facebook account. Unfortunately, the Microsoft account remains under the attacker's control.

We have substantial evidence of the account takeover

After recovering the original email mailbox, we discovered multiple Microsoft security notifications from November 7, 2026, showing the sequence of unauthorized changes:

A Microsoft one-time verification code was requested.

The Microsoft account password was changed.

New security verification information was added.

Existing security verification information was removed.

Additional security information was subsequently added.

We also found a threatening email demanding a ransom, which further confirms that the original email mailbox had been compromised.

Most importantly, we have access to the original Microsoft security notification emails, including details of the unauthorized changes and the attacker's newly added recovery email address.

We can see the complete unauthorized recovery email address in the original Microsoft notification, while Microsoft's recovery interface displays a masked version of that same address.

We are willing to provide all of this evidence through an appropriate, secure channel.

The Microsoft account recovery process is a dead end

We have tried everything we could find:

The official Microsoft account recovery form, which has repeatedly rejected our requests due to insufficient information.

The password recovery process at aka.ms/pwr.

Microsoft telephone support, which is handled by an automated assistant that redirects us to aka.ms/pwr and ends the call.

Microsoft online support chat, accessed using another Microsoft account. Unfortunately, this also led to an AI assistant repeatedly directing us back to the same recovery form.

Every support option leads back to the same automated process that has already failed.

The Microsoft account is an old account that has not been actively used for years. We do not remember its previous passwords or other historical details required by the recovery form.

However, we do have the original email mailbox, the original Microsoft security notifications, the timeline of the attack, and evidence of the unauthorized changes.

I understand that Microsoft has strict account ownership verification requirements, and I fully support protecting users against unauthorized account recovery.

But what is the point of having all this evidence if there is no way to present it to anyone who can actually review the situation?

We are not even insisting on recovering the account

Our primary concern is security.

If Microsoft cannot restore the account, we would at least like to report the confirmed compromise and request that the account be investigated, restricted, or disabled to prevent further misuse.

We do not want an attacker to continue using a Microsoft account associated with the victim's identity.

My questions to Microsoft

Is there any legitimate way to reach a human Microsoft Account Security representative for a case like this?

Is there a secure channel for submitting evidence of an account takeover that the automated recovery form cannot accommodate?

If account recovery is impossible, can a compromised account be reported for investigation or suspension?

How is a legitimate account owner supposed to handle this situation when every support channel redirects them to the same unsuccessful automated recovery process?

We are not asking anyone to bypass Microsoft's security procedures.

We are asking for a way to report a documented account takeover and have the evidence considered, instead of being trapped in an endless loop of AI assistants and automated forms.

Any guidance from Microsoft staff or community members who have dealt with a similar situation would be greatly appreciated.

Thank you.

0 comments

2 answers

Your answer

Answer 1

I have now checked the original Microsoft security notification from November 7, 2026.

It explicitly states that the original recovery email address was removed from the Microsoft account. It does not say that removal is scheduled or pending.

The notification provides a "Review recent activity" button, but this leads to a sign-in process that we cannot complete because the attacker changed the password.

We also have notifications showing that the attacker added new security information.

Could someone from Microsoft please clarify whether the 30-day protection period actually applies in this situation, where the attacker apparently added a new verification method before removing the original one?

And if it does not apply, is there any official way to report this documented account takeover for security investigation without repeatedly submitting the unsuccessful recovery form?

Answer 2

Did you read thorough the AI Answer and see the section regarding using the Sign-in Helper instead of the Recovery form?

"Since the recovery form has already been repeatedly attempted, do not simply resubmit the same information. Run Microsoft’s Sign-in Helper and enter the original account email address or phone number. It checks the account state and may present the applicable self-service action or an agent option."

Microsoft account sign-in helper | Microsoft Support

Note that it's possible the tool may offer an agent option that provides direct access to that channel rather than attempting to call directly, which is designed to fail, since if it were that easy to reach Support then the attackers would have the same easy method resulting in Microsoft Support becoming inundated with requests they can't typically use to verify identity, since that's not something that Microsoft accounts have never inherently contained.

The problem is actually obvious, but most people can't understand the true issues, since they don't understand that the typical 'proof' they hold is actually nothing more than account history, billing, or other similar information that the account itself contains, which the account thief now controls and of course has access to as well.

The deeper problem is that these thieves are professionals with complete technical knowledge of the Microsoft Personal account architecture, so unlike you they don't need to ask any of these questions and thus can act far more quickly to reverse anything you might try to do manually before you can use it to fully regain control.

Since you've indicated you don't really need the account, I'd concentrate on making direct contact via the Sign-in Helper tool, if possible, then be prepared to request that the Support you reach simply disable the account permanently, which is an appropriate request.

Often the Support reps can see that the account has been breached, but in order to protect them from being coerced or tricked by very well-prepared thieves or from often angry original account owners in various stages of grief over the loss of their accounts, Microsoft removed the capability for the agents to do anything other than provide explanations and aid in using the AI tools including the Recovery form that has taken their place.

The confusing part for consumers is they don't understand the simple truths I've laid out above and even though the Sign-in Helper tool page above tries to explain how to proceed, customers still seem to believe that the agents can do something they're not allowed to, specifically to avoid the human mistakes that often resulted in an account being lost.

The only thing that Support can actually do is to either block or disable the account, since that's the only manual recourse that's been left when they truly manage to determine that an account has been breached and is likely unrecoverable or in cases like yours where the recovery is less important than shutting down the ability for the thieves to abuse it further.

Rob