Account was taken over by bad actor

Submit Microsoft’s dedicated account-takeover recovery form at https://aka.ms/recovermyaccount, using historical account details rather than the attacker’s replacement phone number, email, or passkey.^1^

Complete the takeover form

1. Secure the affected computer first.
   • Open Windows Security → Virus & threat protection → Scan options.
   • Select Full scan → Scan now.
   • Microsoft recommends completing a full malware scan before changing credentials.^2^
2. Open https://aka.ms/recovermyaccount.
3. Provide a different working email address that you can currently access. Microsoft will use it to communicate about the recovery request.
4. Supply as much historical information as possible:
   • Previous passwords
   • Old phone numbers and email addresses formerly attached to the account
   • Exact Outlook/Hotmail email subject lines and frequent contacts
   • Xbox console hardware ID, if applicable
   • Skype details, purchases, subscriptions, or billing information
5. Submit the form from a device and location previously used with the account, such as the usual home computer and network. These details improve Microsoft’s ability to recognize the request.^3^
6. Watch the contact email’s Inbox, Spam, and Junk folders. The takeover process should send a message containing a case number beginning with SIR; the matching recovery guidance says to resubmit if that message has not arrived after four hours.^1^

For the standard recovery form, Microsoft sends its decision to the working contact address within 24 hours. If verification fails, Microsoft permits another submission, up to twice per day; add more exact historical information rather than submitting the same answers unchanged.^3^

If the takeover form redirects back to the attacker’s details

Use Microsoft’s compromised-account Sign-in Helper from the hacked-account support page. It asks for the original email address or phone number and then presents applicable self-service recovery or, where available, an option to speak with an agent.^2^

A critical limitation applies if you had already enabled two-step verification before the takeover and have lost access to every configured verification method: Microsoft states that the recovery form cannot bypass it. Support representatives also cannot manually send a reset link or change the account’s security details.^3^

This explains why calling support did not produce a manual reset. Support may guide you through the correct route, but agents are prohibited from directly taking control of the account or replacing its authentication information.^4^

Contain further damage now

While recovery is pending:

• From a known-clean device, change passwords for any other accounts that used the same or a similar password.
• Secure the email account that previously served as the Microsoft account’s recovery address.
• Contact the bank or card issuer promptly if payment information was stored in the account or unauthorized charges appear.
• Preserve Microsoft security-alert emails, receipts, subscription records, previous aliases, and the recovery case number.
• Do not pay anyone claiming they can bypass Microsoft’s recovery process.

If access is restored, immediately replace the password, remove unknown sign-in methods, review account activity, forwarding rules, connected accounts, and automatic replies, and then add authentication methods controlled only by you.^2^

References

1. My account got hacked. - Microsoft Q&A
2. How to recover a hacked or compromised Microsoft account | Microsoft Support
3. Help with the Microsoft account recovery form
4. How to help keep your Microsoft account secure | Microsoft Support