Hello CS, thanks for posting this in the community.
What you are experiencing is a temporary Microsoft security block. It does not mean the account is lost, and it does not mean the ownership has changed. The block simply prevents password changes and new sign-ins from unfamiliar devices until Microsoft’s system is satisfied the activity is safe.
The reason SMS verification fails, even though the number is correct, is because Microsoft’s security system is refusing to send the code. The phone itself is not the issue. This normally happens after too many sign-in or verification attempts in a short period, when the browser or device is flagged as suspicious, or when there is a temporary security hold due to unusual activity or location. This is also why your own account failed to send a verification code the system is protecting itself, not the specific account.
It is also normal that the Outlook app remains signed in. The app uses a cached authentication token, and existing sessions can continue receiving email even when the account is temporarily blocked. This is helpful because it confirms the account is still valid and recoverable.
The most important step is to stop all sign-in attempts for at least 24 hours. Do not try signing in on any browser, phone, app, or device. Avoid triggering any Outlook app password prompts during this period. The goal is to let Microsoft’s security system reset without additional activity.
After waiting 24 to 48 hours with no attempts, using a device and network the account owner usually used in the past, such as her old laptop, home Wi-Fi, or her regular mobile network. Try the password reset again at https://account.live.com/resetpassword.aspx. If the SMS code still does not send after this waiting period, proceed directly to the Microsoft Account Recovery Form at https://account.live.com/acsr and complete the form with all available information.
If the recovery form is unsuccessful, Microsoft allows one submission every 24 hours. Each new attempt should include more details, such as additional recent email subjects, more past passwords, or using the original home network. Providing more accurate information increases the likelihood that the system will confirm ownership. You can refer this the Microsoft article: “Account recovery unsuccessful”
Kind regards,
John Oli