Account recover

Because the attacker replaced the two-step verification details and the recovery attempt failed, use Microsoft’s Sign-in Helper to report the compromised account and obtain the recovery or agent options available for that account. ^1^

What to do now

1. Open the Microsoft hacked-account article above and launch its sign-in helper tool.
2. Enter the original Outlook.com/Microsoft account address or phone number.
3. Follow the option indicating that the account was hacked or that you do not recognize the current security information.
4. If offered an agent option, use it and explain that:
   • The password and two-step verification information were changed.
   • The standard recovery attempt was unsuccessful.
   • You have previous passwords, purchase records, and billing history.

Microsoft specifically directs users who cannot use the recovery form because they do not recognize the added security information to the Sign-in Helper. ^2^

If the Sign-in Helper does not offer recovery

Open Microsoft’s security-support page, select Contact Microsoft Support, enter hacked Microsoft account, select Get Help, and then choose Contact Support if it appears. ^3^

Be aware of the documented limitation: support agents cannot manually send a password-reset link, change security information, or access the account on your behalf. Receipts and old passwords may help when requested by Microsoft’s recovery process, but they do not allow an agent to bypass two-step verification. ^4^

Do not post passwords, receipts, bank details, recovery codes, or email addresses in this public forum. Microsoft Q&A participants cannot access or recover accounts.

Protect payment and device information

• Contact the bank immediately if there are unfamiliar transactions; freeze or replace the affected card if the bank recommends it.
• Change the password of the alternate email account associated with Microsoft.
• Run a full malware scan on devices previously used for the account. On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends completing this scan before changing the compromised account’s password. ^1^
• If access is restored, immediately change the password and inspect Outlook connected accounts, forwarding, and automatic replies for attacker-created settings. ^1^

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. Account recovery unsuccessful | Microsoft Support
3. How to help keep your Microsoft account secure | Microsoft Support
4. Help with the Microsoft account recovery form | Microsoft Support