Recovering a hacked account (submitted multiple requests with no progress)

Question

Recovering a hacked account (submitted multiple requests with no progress)

Panupong Suwan 5

I have submitted account recovery requests multiple times—most recently today—but so far, I have not received any email response or updates.

Additionally, I have important information to share: when I attempt to log in, the screen indicates that I must verify my identity via a backup email address (ir***@web.de**). This is not my email address, and I never linked it to my account. This clearly indicates that the account has been compromised by an unauthorized party who changed the recovery information, preventing me from receiving any verification codes.

I would like to ask the following:

In a situation where the backup email has been changed to one belonging to an unauthorized party, are there alternative identity verification methods that do not rely on the altered email or phone number?

How long does it typically take to receive a response to a recovery request?

Is there a way to escalate this case? This is clearly a case of account takeover, not simply a forgotten password.

This account was hacked some time ago and is used for both work and Xbox. I am deeply concerned about data security and potential ongoing damage, so I am urgently seeking assistance. Thank you very much.

0 comments

1 answer

Your answer

Answer 1

If the backup email was changed to an unauthorized address, the supported recovery paths are still the Microsoft account sign-in helper and the Microsoft account recovery form.

Start with the sign-in helper tool. It can identify the issue and either provide self-help steps or offer the chance to talk to an agent: Start
If sign-in is not possible, use the recovery form guidance: Help with the Microsoft account recovery form
Recovery form results are sent to the working email address entered at the start of the form within 24 hours.
If the account cannot be verified, the form can be retried up to two times per day.
Support agents and advocates are not allowed to send password reset links or access and change account details.

For a compromised account, the documented immediate actions are:

Run a full malware scan on the PC before changing the password. In Windows Security: Virus and threat protection > Scan options > Full scan > Scan now.
After the scan, change the password if sign-in is still possible, or reset it if not.
Review account settings such as connected accounts, forwarding, and automatic replies, because those settings may have been changed after compromise.

If more help is needed, use the support entry points listed here: