my main account got hacked

Use Microsoft’s Sign-in Helper first, then submit the account recovery form if offered; do not post your account address, password, verification codes, or other personal information here.

Recover the account

1. Secure the Windows PC before entering more credentials
   • Open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.
   • Microsoft recommends completing a full malware scan before changing the password, in case credential-stealing malware remains on the computer.^1^
2. Run the Sign-in Helper
   • Open Microsoft’s hacked-account recovery page and start the Sign-in Helper.
   • Enter the original email address or phone number. The tool will provide available self-service recovery steps or an option to contact an agent.^1^
   • Because the hacker replaced the security email, do not keep requesting codes for the unfamiliar Gmail address.
3. Complete the recovery form if directed
   • Recovery form: https://account.live.com/acsr
   • Supply a different, working email address that you control so Microsoft can send the result.
   • Complete it from a device and location previously used with the account, if possible.
   • Include as much historical information as possible:
     • Previous passwords
     • Exact Outlook/Hotmail email subject lines and contacts
     • Xbox console hardware ID, if applicable
     • Skype details
     • Previous purchases or billing information
   • Microsoft normally sends the result to the contact email within 24 hours. If verification fails, the form can be retried up to twice per day.^2^

If the original username now reports that the account does not exist, check Windows Settings → Accounts → Your info on a PC previously connected to it. It may display the account’s changed sign-in address; if found, use that address in the recovery form.^3^

Important limitation

Microsoft support cannot email you a password-reset link, change the account’s security details, or manually transfer the account after being contacted. Account ownership must be verified through the automated recovery process.^4^

The recovery form cannot be used when two-step verification is enabled and none of its verification methods are accessible. The Sign-in Helper remains the correct place to check which recovery or support options are available for the account.^2^

If access is restored

Immediately:

• Set a new, unique password.
• Remove the attacker’s Gmail and any unknown sign-in methods.
• Review recent activity and select This wasn’t me or Secure your account for unauthorized activity.^5^
• Check Outlook forwarding, connected accounts, and automatic replies for attacker-created settings.^1^
• Add your own current security information and enable Microsoft Authenticator or another strong sign-in method.^4^
• Change any other account passwords that reused the compromised password.

Do not send the account details to anyone replying by email or claiming they can recover it for payment.

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. Help with the Microsoft account recovery form
3. My Account has been hacked and the email has been changed. - Microsoft Q&A
4. How to help keep your Microsoft account secure | Microsoft Support
5. What happens if there's an unusual sign-in to your account | Microsoft Support