Someone stole my Microsoft account

Michael Baldwin 0 Reputation points
2026-10-02T00:19:52.0433333+00:00

I received an email security notification from Microsoft advising me someone was attempting to transfer my account. I had previously been contacted by someone who knew me that said they had seen my Minecraft account being listed for sale on Discord, along with a screenshot of the chat there. The following morning is when the email arrived, and I received a phone call from someone who identified themselves as Matthew Collins of Microsoft on Sept 30, with a caller ID of (661) 237-7046, who by all appearances seemed legitimate, and we went through the online options at aka.ms/pwr, which didn't work.

He said he could see the request, asked me to decline it, which I did, he said he would place a lock on the account so it could not be transferred,, but before he could finalize it, he said hs could see than someone else in Microsoft had internally overridden the normal waiting process and approved the account transfer of MikeBaldwin1cox.net, which was very unusual, and there had been people fired at Microsoft for doing it. He said he would have to escalate this to a supervisor, but assured me it would be resolved satisfactorily.

We got disconnected multiple times, but he called me back, and he advised me to create a whole new Microsoft account with a new email address not previously used, for security purposes,, and to text him the numeric portion of the Case number he provided to me of SRX-CASE-27609, followed by the new MS account email address of ******@PetPouchBags.com.

The email used to illegally transfer my account to was ******@proton.me, and I have spent countless hours trying to get my account back, because I cannot access my 365 account or OneDrive, and apparently this is all due to the hacking of Microsoft at the end of August, then exacerbated by someone going in and overriding security protocols by then deleting all of my security email addresses and phone numbers.

I have attempted to resolve this with Microsoft, but keep getting redirected, disconnected, and otherwise frustrated at not being able to gain access to my business documents and sensitive classified data. I need this resolved immediately.

Microsoft 365 and Office | Subscription, account, billing | Other | Windows

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-02T00:20:10.6066667+00:00

    The phone call was not a valid Microsoft recovery path based on the documented support process. Microsoft support agents are not allowed to send password reset links or access and change account details on an account holder’s behalf. For account compromise, the supported path is the Microsoft sign-in helper and the hacked-account recovery flow.

    Recommended actions:

    1. Stop engaging with the caller.
      • Do not share any more codes, case details, passwords, or account information.
      • Do not trust a caller only because the caller ID looks legitimate.
    2. Verify whether Microsoft emails are genuine.
      • Email from the Microsoft account team is trusted only when the sender domain is @accountprotection.microsoft.com.
      • Check the message headers if needed.
      • If a verification code was not requested, do not respond to it.
    3. Treat the account as compromised and use the official recovery flow.
      • Start with the hacked-account recovery process.
      • The sign-in helper asks for the email address or phone number and then either provides self-help steps or offers the chance to talk to an agent.
    4. If access is still possible anywhere, secure the device first, then the account.
      • Run a full antivirus scan before changing the password.
      • In Windows Security: Virus and threat protection > Scan options > Full scan > Scan now.
      • After the scan, change the password. If sign-in fails, use password reset.
    5. If the account is recovered, immediately review account settings.
      • Check connected accounts.
      • Check forwarding.
      • Check automatic replies. These settings may have been changed during the compromise.
    6. If unexpected verification codes continue, do not approve them.
      • Unrequested codes can mean someone is trying to access the account, someone entered the wrong contact by mistake, or a delayed code arrived.
      • Without the code, the account remains protected.
      • Going passwordless is a supported way to reduce repeated code abuse.
    7. If the account is blocked or sign-in remains impossible, use the sign-in helper again or contact support through the official support entry point.
      • The documented support flow is: enter the problem, select Get Help, and if needed select Contact Support.

    Important limitations:

    • Microsoft documents state support agents cannot send password reset links or directly change account details.
    • If the sign-in helper and official recovery process do not succeed, no alternate recovery method is documented here.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.