Hacked Microsoft account: attacker replaced primary alias and removed my email and phone, recovery form rejects me, need escalation

Microsoft Q&A cannot escalate or access the account, so the remaining supported route is to open a case through the hacked-account Sign-in Helper or Contact Support while signed in with a different personal Microsoft account.

Open a support case without repeating the recovery form

Microsoft’s hacked-account process says the Sign-in Helper can offer self-help or an opportunity to speak to an agent ^1^.

1. Open the hacked-account recovery article and start its Sign-in Helper.
2. Enter the original alias and choose the compromised-account options.
3. If it cannot identify the account because that alias was removed, proceed to Contact Microsoft Support from the article.
4. Sign in with a separate, working personal Microsoft account. Create one if necessary.
5. Enter Account Recovery, select Get Help, and then Contact Support.
6. If product/category choices appear, select:
   • Other Products
   • Manage Account Security
   • Chat with a support agent in your web browser

That alternate-account chat route is documented in a closely matching case where the attacker removed the original alias ^2^.

At the start of the chat, state:

My personal Microsoft account was taken over. The attacker changed the primary alias and removed my original alias and phone number. The recovery form has already failed several times, and the original alias is no longer recognized. Please create a compromised-account case and check whether an unauthorized alias/security-information change workflow is available. My evidence can be supplied privately.

Ask for the case number before the conversation ends. Do not publish the attacker’s alias, passwords, message headers, or other identifiers in Q&A.

Evidence to prepare

The notices are useful supporting evidence, but Microsoft does not document them as sufficient proof of ownership by themselves. Preserve:

• The three original security messages, including full message headers if available.
• Exact timestamps for the security-info addition, primary-alias change, and deletion.
• The previous OneDrive notice showing historical use of the original address.
• The original alias and any known replacement alias.
• Approximate account-creation date and commonly used devices/locations.
• Previous passwords, contacts, subject lines, subscriptions, order information, or Xbox details only if available—do not invent answers.

Alias changes and security-information removal are account activity types Microsoft records, but the Recent Activity page is accessible only after sign-in ^3^. Ask the agent to note the dates from your notices in the case; the available documentation does not confirm that an agent can disclose or manually reverse the corresponding backend records.

Microsoft also states that support agents cannot send password-reset links or directly access and change account details ^4^. Escalation therefore does not guarantee restoration; ownership still must be established through the available process.

If a security-change-pending screen appears

This branch applies only if a sign-in attempt displays Scheduled for removal or a pending security-information change. Microsoft applies a 30-day waiting period before a removed verification method is deleted, and the old method can still be usable during that period. Sign in to Additional security options, expand the affected method, and select Cancel removal ^5^.

If no pending-status screen appears and the notices confirm deletion already completed, this option is no longer available.

Locking or closing the inaccessible account

There is no documented self-service procedure for asking Microsoft to lock an inaccessible account merely by supplying its former alias. The account-lock article describes how to recover an account that Microsoft has already locked; it is not a lock-request mechanism ^6^.

Closing the account is also unavailable without regaining access: Microsoft requires sign-in and identity verification before an account can be marked for closure ^7^. Ask the support agent to record that the attacker retains control and whether any protective restriction is available, but do not expect Q&A moderators or ordinary support agents to close it manually.

Meanwhile, secure the original mailbox from which the notices were deleted: change its password, remove unknown recovery methods and sessions, enable multifactor authentication, and scan devices before reusing credentials.

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. HACKED ACCOUNT - Microsoft Q&A
3. What is the Recent activity page? | Microsoft Support
4. How to help keep your Microsoft account secure | Microsoft Support
5. What does 'Scheduled for removal' mean? | Microsoft Support
6. Microsoft account has been locked | Microsoft Support
7. How to close your Microsoft account | Microsoft Support