Account hacked

To regain access to a hacked Microsoft account where the primary alias and security info were changed, only the official self-service recovery flows can be used; support agents cannot reset passwords or change account details.

Follow these steps:

1. Use the hacked-account recovery guide and Sign-in Helper

• Start with the official guidance for compromised accounts: How to recover a hacked or compromised Microsoft account.
• Use the built-in Sign-in Helper tool referenced there and here: Open the Sign-in Helper for support options or hacked account issues.
  • Enter the username/phone/email for the hacked account.
  • The tool will either show self-help options or offer a way to talk to an agent.

2. Make sure the account recovery form was submitted correctly

• The recovery form is described here: Help with the Microsoft account recovery form.
• Step 1 requires a working email address that can currently be accessed; Microsoft sends the result of the request there.
• After submission, Microsoft normally sends a result within 24 hours to that working email. If no message arrived after 48 hours:
  • Check junk/spam folders in the working email account.
  • Try submitting the form again from a different browser (InPrivate/Incognito), device, or network, as suggested in similar cases.

3. If the recovery request was not granted

• If the result email says the request was not successful, see: Account recovery unsuccessful.
  • It is possible to retry the form up to two times per day.
  • Before retrying, review the guidance video and article linked there to improve the accuracy and completeness of the information provided.
• If the security info (alternate email/phone) was fully replaced by the attacker and the recovery form repeatedly fails, community and support guidance indicates there is no other working method to recover the account, and Microsoft Support cannot override the automated checks.

4. If the account is in “security info change pending” state

• If at any point a sign-in shows a message like “Your security info change is still pending” or “You can’t access this site right now,” that means all previous security info was removed and replaced, and the change takes 30 days to take effect.
• On that pending screen, use whichever of these options appears:
  • Cancel this request – only if that change was initiated and the old security proofs are still accessible.
  • Let us know – if the change was not made by the account owner; this routes through the unauthorized-change flow.

5. After regaining access If access is restored:

• Immediately run a malware/antivirus scan on all PCs used to sign in, as described in Step 1 of How to recover a hacked or compromised Microsoft account.
• Change the password to a strong one.
• Review account settings (connected accounts, forwarding, automatic replies) as described in the same article.
• Add secure verification methods (e.g., Microsoft Authenticator, trusted phone/email) using the guidance in Help with the Microsoft account recovery form.

Because support agents are not allowed to send password reset links or modify account details, all recovery must go through the Sign-in Helper and the account recovery form. If those automated processes do not verify ownership, the account and its OneDrive data cannot be recovered.

References:

• How to recover a hacked or compromised Microsoft account
• Hello , welcome to Account help & learning
• Help with the Microsoft account recovery form
• Account recovery unsuccessful
• My username and password have stopped working
• My account got hacked. - Microsoft Q&A
• My account got hacked - Microsoft Q&A
• my microsoft account has been compromised - Microsoft Q&A
• Need help with hacked microsoft account - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A