My Microsoft account has been hacked

Use Microsoft’s Sign-in Helper now because the attacker replaced the security information; it can direct you to applicable self-service recovery or offer contact with an agent.^1^

1. Secure the device first

Before entering any new credentials:

1. Open Windows Security.
2. Select Virus & threat protection → Scan options → Full scan → Scan now.
3. Remove or quarantine anything detected.
4. Change the passwords of the contact email, banking/payment, and other accounts that shared this Microsoft account’s password.

Microsoft recommends completing a full malware scan before changing the compromised account’s password.^1^

2. Use the Sign-in Helper

Open the Sign-in Helper from the compromised-account support page above and enter the original Microsoft account address or phone number. Follow the route for an account that was hacked and whose security information is no longer recognized.

If it offers an agent, use that option. Be aware that support can explain available recovery routes, but agents cannot send a password-reset link or manually change the account’s security details.^2^

3. Make any new recovery submission materially stronger

Since the previous recovery attempt failed, do not resubmit the same information unchanged. Microsoft permits further attempts, limited to two per day.^3^

For the next attempt:

1. Submit it from a device and location previously used with the account.
2. Provide a different working email address for Microsoft’s response.
3. Supply as many historical details as possible:
   • Previous passwords.
   • Exact Outlook/Hotmail email subject lines and contacts.
   • Xbox console hardware ID from a frequently used or older console.
   • Skype ID, contacts, or purchase details.
   • Subscription and billing information requested by the form.
4. Use details that were valid when the account was originally created, including an older name or address where applicable.
5. Expect the result at the working contact address, normally within 24 hours.

Microsoft states that guessing is acceptable where uncertain—incorrect answers do not count against you—and recommends filling every available “add more” field.^4^

The fact that the attacker disabled Authenticator does not itself establish whether you had enabled two-step verification before the compromise. If you had enabled it and no longer have any alternate verification method, Microsoft documents that the recovery form and support cannot bypass that protection.^4^

4. Protect billing immediately

If the compromised account has Microsoft 365 recurring billing or saved payment methods:

• Contact the card issuer or payment provider, report the account compromise, and monitor for unauthorized charges.
• Use another Microsoft account to open Contact Microsoft Support, enter the issue, select Get Help, and then Contact Support if offered.^2^
• Ask support specifically for help with subscription billing or unauthorized charges. This is separate from asking them to override account ownership verification.

If access is restored, immediately change the password, review connected accounts, forwarding rules and automatic replies, then replace all security information and add more than one recovery method.^1^

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. How to help keep your Microsoft account secure | Microsoft Support
3. Account recovery unsuccessful | Microsoft Support
4. Help with the Microsoft account recovery form