Outlook account hacked: attacker added their email as recovery contact, can't remove it

If sign-in displays “Your security info change is still pending” or “You can’t access this site right now,” select “let us know” on that page to report that you did not authorize the replacement security email. ^1^

If a security-info change is pending

1. Open the Microsoft account Security page: https://account.live.com/proofs/Manage
2. Sign in as far as the process permits.
3. On Your security info change is still pending, select let us know near the bottom.
4. Follow the unauthorized-change prompts.

Do not select cancel this request: that option is intended for someone who initiated the change and still has access to the previous verification methods.

When all security information is replaced, Microsoft places the account in a restricted state for 30 days. Microsoft cannot expedite that period. If two-factor verification was already enabled, access during the pending period is more restricted. ^1^

If there is no pending-change page

Since the account recovery form and password reset have already been attempted, use Microsoft’s hacked-account sign-in helper instead. Enter the affected Outlook address; the tool provides the available self-service path or may offer contact with an agent. ^2^

If the helper cannot restore access:

1. Open Contact Microsoft Support from the support article.
2. Enter hacked Microsoft account and select Get Help.
3. Select Contact Support if offered.
4. If sign-in is required, use a different working personal Microsoft account.
5. Choose Other Products and Manage account security, then request chat or the available support option.

Support can guide the recovery process, but agents cannot send password-reset links or directly access and change account details, including removing the attacker’s recovery address. ^3^

Immediately after regaining access

Perform these actions from a trusted device:

1. Scan the device first
   • Open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.
   • Because the password was already reset before this scan, change it again afterward to a new, unique password. Microsoft recommends scanning before changing a compromised account’s password. ^2^
2. Replace the unauthorized verification method
   • Open Advanced security options.
   • First select Add a new way to sign in or verify and add an email, mobile number, Authenticator, or another method you control.
   • Expand the attacker’s verification email, select Remove, then confirm.
   • Do not remove every verification method simultaneously; removing all security information triggers the 30-day restricted state. ^4^
3. Review account activity
   • Open the Microsoft account Recent activity page.
   • Expand entries from the last 30 days.
   • For unauthorized entries under Unusual activity, select This wasn’t me. For suspicious entries under Recent activity, select Secure your account.
   • Review changes such as aliases added, alternate email added, two-step verification changes, application permissions, and successful sign-ins. ^5^
4. Check Outlook persistence settings
   • Inspect connected accounts, forwarding, and automatic replies and remove anything you did not configure. These settings can remain altered after unauthorized mailbox access. ^2^
5. Secure linked services
   • Change any other account that reused the old password.
   • Start with the recovery email account, banking/payment services, shopping accounts, social networks, Xbox, OneDrive, and services where Outlook receives password-reset messages.
   • Review Microsoft subscriptions and payment activity for unauthorized changes.
   • Enable Microsoft Authenticator or another strong verification method and keep more than one recovery method current. ^3^

Do not publish the attacker’s full address, your account details, recovery codes, purchase records, or other ownership evidence in a public Q&A thread; provide sensitive details only through Microsoft’s official recovery or support interface.

References

1. What does “Security info change is still pending” mean? | Microsoft Support
2. How to recover a hacked or compromised Microsoft account | Microsoft Support
3. How to help keep your Microsoft account secure | Microsoft Support
4. Removing a sign-in verification method | Microsoft Support
5. What is the Recent activity page? | Microsoft Support