Managing personal Outlook.com account settings, security, and privacy
Submit the dedicated compromised Microsoft account takeover form at https://support.xbox.com/forms/recover-your-microsoft-account, because the ordinary recovery process already rejects the former Gmail address and this form is specifically intended for takeover cases involving changed account details.^1^
Submit the takeover case
- Open the form from a device and network previously used for Xbox or Minecraft, if available.
- Supply an accessible alternate email address for Microsoft’s response.
- Enter the original Gmail address and every historical identifier available:
- Previous passwords.
- Old recovery email addresses and telephone numbers—even inactive ones.
- Xbox gamertag and device/console details.
- Minecraft purchase date: October 30, 2026.
- Microsoft order number and the Amazon order/receipt details.
- The date and wording of the unexpected Thunderbird authorization.
- Approximate date and time when Xbox and Minecraft signed out.
- Be exact rather than guessing. The matching recovery guidance specifically identifies “Alternate emails or phone numbers associated with the account” as important.
- Monitor the alternate mailbox, including Junk/Spam, for an account-safety response and case number.
Do not post the receipt, redemption code, order number, email address, or case number publicly. Preserve the original emails with their message headers and take screenshots of the errors and Thunderbird notice.
Contact support and request escalation
Also open Microsoft’s official support page and choose the Personal account tab:
- Select Get Help.
- Enter:
Compromised Microsoft account – original sign-in alias no longer recognized. - Continue to Contact Support if offered.
- Request an account-compromise/account-takeover case, and provide the takeover-form case number if one has been issued.
- State that:
- The original Gmail sign-in now returns “account doesn’t exist.”
- Xbox and Minecraft sessions were terminated unexpectedly.
- An unrecognized application was granted access.
- The standard recovery and account-check processes already failed.
- A recently redeemed Minecraft Java & Bedrock purchase is attached to the inaccessible account.
- Original Amazon and Microsoft purchase confirmations are available through a secure upload channel.
Support may provide chat or another appropriate contact option, but support agents are not permitted to send password-reset links or directly access and change personal-account details.^2^ Therefore, ask the agent to record and route the compromise, rather than requesting that the agent manually change the account alias.
The purchase documents support an ownership investigation, but they do not themselves provide access to the account or automatically transfer the Minecraft entitlement to another account.
Contain the suspected compromise now
The Thunderbird event means that permission was granted to an application; combined with the forced sign-outs, it should be treated as suspicious, although it does not by itself identify who granted access.^3^
Before changing other credentials:
- Run a full malware scan on every computer used with the account. On Windows, open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends scanning before changing passwords in a compromised-account incident.^4^
- From a clean device, change the Gmail password and enable two-step verification.
- Review Gmail forwarding rules, recovery details, active sessions, and third-party application access.
- Change any other account that reused the Microsoft password.
- Do not approve Microsoft Authenticator prompts that were not initiated personally.
If Microsoft restores access, immediately change the Microsoft password, remove unfamiliar aliases/security methods and application permissions, review recent activity, and verify that Minecraft appears under the recovered account.
References