Hacked xbox account and email

Use the account-reinstatement link shown in the disabled/locked-account message, because this review is separate from ordinary password recovery and is the supported route for requesting restoration.

Submit the reinstatement request

1. Attempt to sign in to the affected Microsoft account.
2. On the locked/disabled message, select the link beginning with aka.ms/.
3. Complete the reinstatement form with an email address you can currently access.
4. Explain clearly that:
   • The Microsoft/Outlook account was taken over.
   • Its security information was changed.
   • Two-step verification was enabled by the attacker.
   • The account was subsequently disabled.
   • Include the original email address and Xbox gamertag, plus any old passwords, purchases, billing details, and devices you remember.
5. Submit one request, then monitor the contact email, including its spam folder. Microsoft says an Online Safety support agent reviews these requests and that submitting duplicates can delay the response.^1^

The console serial number and 25-digit recovery code are not the only possible ownership information. Provide whatever historical information is available, but never post passwords, payment details, or other private information publicly.

Important two-step verification limitation

Do not rely on the ordinary Microsoft account recovery form while two-step verification is active and none of its verification methods are accessible. Microsoft states that support cannot bypass two-step verification, send a password-reset link, or manually change account details in that situation.^2^

The reinstatement request above is different: Microsoft’s locked-account documentation specifically directs users to the link displayed in the lock window and identifies that form as the route through which the account’s status is reviewed.^1^

If reinstatement is denied and no valid two-step verification method remains available, regular support cannot manually override those security controls or restore access.^2^

If no reinstatement link appears

Use Microsoft’s Sign-in Helper from the compromised-account support page. Enter the original email address or phone number; the tool will provide the applicable self-service route or may offer contact with an agent.^3^

The ordinary recovery form is only a conditional fallback if two-step verification is not actually active, or if Microsoft’s sign-in flow specifically makes that recovery option available. If permitted, submit it from a familiar device and location and provide old passwords, Xbox hardware information you still have, and account history. Microsoft normally sends the result to the working contact email within 24 hours.^2^

Protect anything else that may be exposed

• Change the password of any separate email account connected to Microsoft or Xbox.
• Change reused passwords on other services.
• Check bank or card activity and contact the payment provider about unauthorized charges.
• Scan any Windows PC previously used with the account for malware before changing passwords.^3^
• Ignore anyone offering paid account recovery. Only Microsoft can perform the reinstatement review.

References

1. Microsoft account has been locked | Microsoft Support
2. Help with the Microsoft account recovery form | Microsoft Support
3. How to recover a hacked or compromised Microsoft account | Microsoft Support