How to recover child account after hacker changed the email

Submit the specialized Microsoft account-takeover form at https://aka.ms/recovermyaccount, because the ordinary recovery process cannot locate the child’s removed sign-in address. This route is specifically recommended for a child account whose attacker changed the associated email address.^1^

Submit the strongest possible ownership evidence

Use an accessible email address for Microsoft’s response, and provide:

• The child’s original email address.
• The attacker’s replacement @outlook.com address shown in Family Safety, if its full value is visible.
• Xbox gamertag, console serial number, and device ID.
• Previous passwords.
• Microsoft/Xbox order numbers, receipts, approximate purchase dates, game titles, redeemed codes, and the last four digits of the payment card.
• The approximate date when access was lost.

Do not post any of this information publicly.

Escalate when the original username is not recognized

Since the ordinary recovery workflow has already failed, use Microsoft’s hacked-account sign-in helper. It asks for an email address or phone number and can either present the relevant recovery route or offer assisted support.^2^

Alternatively:

1. Open Contact Microsoft Support.
2. Enter Hacked Microsoft account — original username no longer recognized.
3. Select Get Help, then Contact Support.
4. Sign in using the parent’s Microsoft account or another working account.
5. State clearly that:
   • this is a minor’s Microsoft/Xbox account;
   • the attacker removed or replaced the original alias;
   • the replacement address is visible in Family Safety;
   • the standard recovery process says the original account does not exist;
   • Xbox purchases and the gamertag are attached to the compromised account.

Microsoft specifically directs users who still receive “We couldn’t find an account with that username” to contact support and report that the username stopped working.^3^

Support cannot simply send a verification code, reset link, or manually replace security information without completing Microsoft’s ownership-verification process.^4^

Why Family Safety did not prevent the email change

A Family Safety organizer can manage screen time, filters, purchase permissions, spending, activity reporting, and consent. The organizer role is not documented as having authority over a member’s password, aliases, or security-verification methods.^5^

The Microsoft documentation does not state that organizers receive notifications when a child’s sign-in alias changes. The address shown now is evidence worth including in the takeover report, but Family Safety cannot be used to change it back.

Purchases and Xbox data

Do not create a replacement account expecting the purchases or gamertag to be transferred. Microsoft personal accounts cannot be merged, and game progress, gamertags, purchases, and balances cannot be transferred between them.^6^

Recovering the original account is therefore the path for retaining those purchases. Meanwhile:

• Remove stored payment methods through the card issuer if unauthorized charges are possible.
• Review the parent’s payment statements and report unrecognized transactions.
• Secure the parent account with a unique password and an additional sign-in method.
• Before changing recovered credentials, run a full malware scan on devices used for the account; Microsoft recommends scanning before changing the password.^2^

References

1. Son's account hacked - hacker changed associated e-mails - Microsoft Q&A
2. How to recover a hacked or compromised Microsoft account | Microsoft Support
3. My username and password have stopped working | Microsoft Support
4. Troubleshoot Microsoft verification code issues | Microsoft Support
5. Roles, permissions and data sharing in Family Safety | Microsoft Support
6. Combining Microsoft accounts | Microsoft Support