Hotmail account recovery if you have two-way factor but email is hacked

Use Microsoft’s Sign-in Helper for the compromised Hotmail address; it can present applicable self-service options or offer contact with a support agent for a hacked account.^1^

Recovery and escalation

1. On a safe device, open the Sign-in Helper: https://go.microsoft.com/fwlink/?linkid=2214157
2. Enter the original Hotmail address and select the options indicating that the account was hacked and that you cannot use the displayed verification methods.
3. If offered, choose the option to speak with an agent.
4. If no agent option appears, open Contact Microsoft Support, enter Account recovery, and select:
   • Get Help
   • Contact Support
   • The available browser-chat or callback option
   Use a different working Microsoft account if authentication is required. Microsoft documents this support-routing process but does not guarantee that every contact method will always be available.^2^

When contacting support, provide:

• The original Hotmail address.
• Previous passwords.
• The approximate date access was lost.
• The original recovery email or telephone number.
• Xbox Gamertag, console details, purchases, order information, and billing evidence.
• Screenshots or notifications showing when the password and security information changed.

Do not send a verification code to the attacker-controlled address. Support can review the recovery options, but agents cannot send password-reset links, bypass two-step verification, or manually change account details.^3^

Since the recovery form has already explicitly said it will be ignored because two-step verification is active, repeatedly submitting that same form will not address this situation. A closely matching Hotmail case identifies Microsoft account support as the remaining official route after both the form and two-step-verification methods are unavailable.^4^

Protect everything else immediately

From a clean device:

1. Change the password on the separate email account that was formerly used for recovery.
2. Change passwords on any account that reused the Hotmail password.
3. Contact the bank or card issuer if payment information was stored in the Microsoft account.
4. Run a full malware scan before changing more passwords: Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.^1^
5. Preserve purchase receipts and compromise notifications; do not delete them.
6. Do not pay anyone claiming they can bypass Microsoft’s verification system.

If access is restored, immediately change the password, remove unknown security methods, review Outlook forwarding and connected accounts, and add more than one verification method.^1^

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. How to help keep your Microsoft account secure | Microsoft Support
3. Help with the Microsoft account recovery form | Microsoft Support
4. Need help with a hotmail account - Microsoft Q&A