Username and Account access

While you can still access the account using the unfamiliar username, immediately re-add your original email as an alias, make an address you control the primary alias, and only then remove the unauthorized alias.

Restore control of the account aliases

An alias is an email address or phone number used to sign in to the same Microsoft account; aliases share the account’s password, storage, contacts, subscriptions, and settings.^1^

1. Using a trusted device, sign in with the unfamiliar username that currently gives you access.
2. Open Your info → Edit account info at: https://account.live.com/names/manage
3. Select Add email.
4. Try to re-add your original email address and complete any verification requested.
   • If Microsoft does not permit that address to be re-added, add another email address that only you control.
5. Test the controlled alias by signing out and signing back in with it.
6. If the unfamiliar address is marked as the primary alias, make your controlled alias primary first.
7. After confirming that the controlled alias works, select Remove beside the unfamiliar alias if that option is available.

Treat alias removal as potentially irreversible, particularly for Microsoft-owned addresses such as Outlook.com or Hotmail. Record the unfamiliar address privately and verify the controlled alias works before removing anything. Do not publish either address here.

Secure the account

Alias settings and security verification methods are separate. Changing an alias does not by itself remove an attacker’s recovery email, telephone number, Authenticator registration, or other sign-in method.

1. Scan the device first.
   • On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.
   • On another platform, run a full scan using its updated security software.
   Microsoft recommends completing the malware scan before changing the password.^2^
2. Change the Microsoft account password to a new, unique password not used anywhere else.
3. Open Security → Advanced/Additional security options and:
   • Remove recovery addresses, phone numbers, or sign-in methods you do not recognize.
   • Add a recovery email or phone number you control.
   • Enable Microsoft Authenticator or another two-step verification method.^3^
4. Under Security → Review activity, expand unauthorized entries and choose This wasn’t me or Secure your account, where offered.^4^
5. In Outlook.com, inspect connected accounts, forwarding, and automatic replies for changes made by the unauthorized person.^2^

Also change the passwords of any other accounts that reused the old password.

If Microsoft prevents the alias changes

Use Microsoft’s compromised-account Sign-in Helper. It asks for an email address or phone number and can present self-service recovery or an option to speak with an agent.^2^

If the original address is no longer recognized, contact Microsoft Support from another working account and describe the issue specifically as:

“Account takeover: an unauthorized person replaced my primary alias. I can currently access the account only through the unauthorized alias.”

Ask whether the case qualifies for account-takeover review. Keep previous account details, Microsoft security notifications, purchase history, and device information available, but submit them only through Microsoft’s private support channel. Support must verify ownership and is not permitted simply to send password-reset links or directly change account details.^5^

References

1. Change the email address for your Microsoft account | Microsoft Support
2. How to recover a hacked or compromised Microsoft account | Microsoft Support
3. How to help keep your Microsoft account secure | Microsoft Support
4. What happens if there's an unusual sign-in to your account | Microsoft Support
5. Microsoft account compromised: primary alias changed and original email no longer recognized - Microsoft Q&A