Account hacked and security details changed

Submit the specialized Microsoft account-takeover form rather than repeating the standard recovery form, because the attacker replaced the account’s email alias and security information.

1. Submit the account-takeover form

1. Open https://aka.ms/recovermyaccount.
2. Provide:
   • The original Microsoft email address.
   • The attacker’s replacement address, if known.
   • Previous passwords.
   • Previously associated email addresses and phone numbers.
   • Purchase receipts, order details, and redeemed product codes.
   • Xbox Gamertag, console serial number, and device ID, if applicable.
   • A separate email address that you can currently access.
3. Submit the form and monitor that contact address, including its Spam and Junk folders.

This route is specifically recommended in closely matching cases where an attacker removed the original alias and replaced the email address and phone number.^1^ Another matching account-takeover case advises entering security addresses and phone numbers that were previously associated with the account.^2^

2. Use the official Sign-in Helper if the takeover form fails

Because you have already exhausted the ordinary recovery form and supplied additional evidence, do not simply submit the same information through the same path again. Open Microsoft’s hacked-account guidance and run the Sign-in Helper. It asks for the affected email address or phone number and can either provide the applicable recovery route or offer the opportunity to speak to an agent.^3^

If an agent option appears:

1. Sign in using another working Microsoft account if necessary.
2. Select Get Help and then Contact Support.
3. State that:
   • The original alias and security details were replaced.
   • The standard recovery form has already failed.
   • Additional ownership evidence was already submitted.
   • You need the case reviewed as an account takeover, not another password-reset attempt.
4. Provide the existing case number so the history remains attached.

What support can and cannot do

Microsoft states that support agents cannot send password-reset links or directly access and change account details. Consequently, receipts, device IDs, old passwords, and similar evidence must be assessed through the authorized recovery process; an agent cannot manually bypass its identity checks.^4^

The standard recovery form may be submitted up to twice per day, but that is only useful if you can add materially better information. Microsoft recommends completing it from a previously used device and familiar location, with exact email subject lines, old passwords, billing details, and the hardware ID of a frequently used Xbox console.^5^ Since you have already made repeated attempts, prioritize the takeover form and Sign-in Helper instead of sending unchanged submissions.

Secure the Windows 11 PC and related accounts

Before changing any recovered credentials, run Windows Security → Virus & threat protection → Scan options → Full scan → Scan now. Microsoft recommends scanning for malware before changing the password.^3^

Also change any reused passwords on other accounts from a known-clean device, beginning with the contact email and financial accounts. If access is restored, immediately:

• Set a unique password.
• Remove unknown aliases, forwarding rules, connected accounts, devices, and security methods.
• Add more than one recovery method.
• Enable Microsoft Authenticator or another strong sign-in method.

There is no community-side mechanism that can restore the account or inspect the escalation. If both the account-takeover process and Sign-in Helper’s assisted route reject the ownership claim, the documented security restrictions leave no supported manual override.

References

1. HACKED ACCOUNT - Microsoft Q&A
2. My account got hacked. - Microsoft Q&A
3. How to recover a hacked or compromised Microsoft account | Microsoft Support
4. How to help keep your Microsoft account secure | Microsoft Support
5. Help with the Microsoft account recovery form | Microsoft Support