Hotmail account recovery if you have two-way factor but email is hacked

Question

Hotmail account recovery if you have two-way factor but email is hacked

Emina 0

Our email was hacked and they changed the recovery e-mail and password before we could see the notifications.

When we try and fill our recovery email request form it says it will ignore it because we have a two-step verification set up on the account.

What are our other options to recover our access to the hotmail account. We can not log into xbox either or anything else because on the other apps we have the email that was hacked listed as to send the verification code to. If we do that the hacker will get the code.

Please someone help because this not having a phone number to contact Microsoft is frustrating.

0 comments

2 answers

Your answer

Answer 1

Hi @Emina

I’m truly sorry that you are going through this, especially since the recovery information was changed before you had a chance to secure the account.

Please note that this is a user-to-user support forum. Moderators, contributors including external Microsoft employees cannot directly intervene in Microsoft product features or access back-end systems. Our role is limited to providing technical guidance on reported issues, requests, or ideas only.

Because two-step verification was enabled, the recovery form cannot be used when none of the registered verification methods are still accessible. Unfortunately, support representatives are also unable to bypass this protection or manually replace the security information.

Before giving up on the account, please check whether you still have access through a previously signed-in device, the original Authenticator app, a recovery code, or any other verification method that was added before the account was compromised.

If none of these options is available, I’m afraid there may be no supported way to restore access. In that case, you may need to create a new Microsoft account and update the sign-in address for any services linked to the compromised account.

I understand this is not the answer you were hoping for, and I’m sorry that there is no simpler recovery option in this situation.

Emina 0 Reputation points

2026-11-05T14:03:53.8733333+00:00

So it was not a 2FA that was set up. We had a two- way verification which had another email set up to notify so by the time that email was seen they already changed everything.

We were logged into the Hotmail on the phone but that is promoting us to sign in so they probably selected the option to sign you out of any other devices because I did that on my other email when I re-set the password after we were hacked.

Even if I provide the console information and prove that I physically have it can nothing be done to gain access to the account? I am more concerned about recovering everything we had on Xbox.

Microsoft only sends the notification to the other email saying someone changed the recovery email and if it was you to ignore it but if not then to go change your password or check your account. There is no option on the email to say it wasn't you unless you go under the sign-in activity and there you have the option to day it wasn't you. By that time if they change your password it is too late.

Answer 2

Use Microsoft’s Sign-in Helper for the compromised Hotmail address; it can present applicable self-service options or offer contact with a support agent for a hacked account.^1^

Recovery and escalation

On a safe device, open the Sign-in Helper: https://go.microsoft.com/fwlink/?linkid=2214157
Enter the original Hotmail address and select the options indicating that the account was hacked and that you cannot use the displayed verification methods.
If offered, choose the option to speak with an agent.
If no agent option appears, open Contact Microsoft Support, enter Account recovery, and select:
- Get Help
- Contact Support
- The available browser-chat or callback option
Use a different working Microsoft account if authentication is required. Microsoft documents this support-routing process but does not guarantee that every contact method will always be available.^2^

When contacting support, provide:

The original Hotmail address.
Previous passwords.
The approximate date access was lost.
The original recovery email or telephone number.
Xbox Gamertag, console details, purchases, order information, and billing evidence.
Screenshots or notifications showing when the password and security information changed.

Do not send a verification code to the attacker-controlled address. Support can review the recovery options, but agents cannot send password-reset links, bypass two-step verification, or manually change account details.^3^

Since the recovery form has already explicitly said it will be ignored because two-step verification is active, repeatedly submitting that same form will not address this situation. A closely matching Hotmail case identifies Microsoft account support as the remaining official route after both the form and two-step-verification methods are unavailable.^4^

Protect everything else immediately

From a clean device:

Change the password on the separate email account that was formerly used for recovery.
Change passwords on any account that reused the Hotmail password.
Contact the bank or card issuer if payment information was stored in the Microsoft account.
Run a full malware scan before changing more passwords: Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.^1^
Preserve purchase receipts and compromise notifications; do not delete them.
Do not pay anyone claiming they can bypass Microsoft’s verification system.

If access is restored, immediately change the password, remove unknown security methods, review Outlook forwarding and connected accounts, and add more than one verification method.^1^

References