Account with 2FA enabled got hacked

Question

I recently downloaded and executed a program I should of executed and I lost access to my hotmail account which was linked to my personal computer. Since I have 2FA enabled I can't use the recovery form. How can I recover the account or can I authorize deletion of the account?

Answer 1

Because two-step verification is enabled and access to the security methods is lost, normal account recovery options are very limited.

Key points from Microsoft’s guidance:

1. When 2FA is on and no security methods are available
   • If two-step verification is turned on and there is no access to any of the alternate methods (phone, email, authenticator app), support agents cannot bypass this or reset the password.
   • They are not allowed to send password reset links or change account details for security reasons.
   • The standard Microsoft account recovery form cannot override 2FA in this situation.
2. What can still be tried
   • Use the Sign-in Helper tool to see if any self-service options are still available for the account: Sign-in Helper.
   • If any security info is still accessible (for example, one phone number or email), follow the guidance for “I’ve lost access to some, but not all, of my security info” and update security info from the Advanced security options page.
3. If all security info is lost and password is not known
   • For Microsoft accounts without usable security info and with a forgotten password, the only supported path is the account recovery form: Help with the Microsoft account recovery form.
   • However, the documentation explicitly states that if two-step verification is enabled and none of the verification methods are available, Microsoft cannot help further and the form cannot be used to bypass 2FA.
4. Account deletion/closure
   • There is no supported way to authorize deletion of a Microsoft account if sign-in and required verification cannot be completed. Deletion also requires successful authentication and cannot be requested externally by support.
5. Device and malware cleanup (since a malicious program was run)
   • Run a full antivirus/malware scan on all devices that used the account. If using Windows 10/11 or 8.1, ensure Windows Defender (or another antivirus) is up to date and perform a full scan.
   • Only after devices are clean should any further sign-in or recovery attempts be made.

If at least one 2FA method (phone, email, or app) can be recovered, use it to sign in, then immediately:

• Change the password to a strong one.
• Review security info and remove anything unfamiliar.
• Check forwarding, connected accounts, and automatic replies for malicious changes.

---

References:

• Help with the Microsoft account recovery form
• Troubleshoot Microsoft verification code issues
• Common problems with two-step verification for a work or school account
• How to recover a hacked or compromised Microsoft account
• I can't sign in to my Microsoft account