Share via

My email account got hacked - unable to update recovery email

Maria G 0 Reputation points
2026-03-02T00:06:10.57+00:00

My hotmail account got hacked. Folder were renamed in Vietnamese language. I was able to change password and to change folder language back to English.

However, the hacker changed my recovery email. When I enter my recovery email to send a code, it does not recognize my recovery email.

Its now whatever the hacker changed it to.

How can I access my recovery email to change it back to what it was?

Outlook | Web | Outlook.com | Account management, security, and privacy
0 comments No comments
{count} votes

3 answers

Sort by: Most helpful
  1. Maria G 0 Reputation points
    2026-03-02T01:12:16.4933333+00:00

    Thank you!! I will check the link you mentioned manage sign in in 30 days!!


  2. Emmanuel Santana 37,405 Reputation points Independent Advisor
    2026-03-02T00:43:47.7633333+00:00

    Hello. If you were able to reset your password, that indicates you still have access to the account, is that right?

    Please go to the following page and check the section labeled “Ways to prove who you are”:

    https://account.live.com/proofs/manage/additional

    If you’re able to access it, look for any recovery email you don’t recognize and remove it from the list.


  3. Q&A Assist
    2026-03-02T00:06:23.42+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    Because the recovery email was changed by the hacker, the previous recovery email can’t be used or “seen” anymore, and it can’t simply be reverted from the outside. The only supported way to fix this is to go through Microsoft’s account recovery and security processes and then update the security info once access is restored.

    Follow these steps:

    1. Verify you’re using the correct sign-in details
      Make sure the primary email address (including the correct domain like outlook.com, hotmail.com, etc.) is typed correctly. If the username isn’t recognized, try any other alias or phone number that might be on the account, as described in My username and password have stopped working.
    2. Use the standard account recovery flow
      Since the recovery email and possibly other security info were changed, use the “Forgot my password” / “Recover your account” path and follow the prompts:
      • Go to the password reset page (for example via Recover your account in the guidance).
      • When asked where to send a security code and you don’t recognize or can’t access the options, choose I don’t have any of these (this appears in both consumer and work/school flows).
      • This will lead to the Microsoft account recovery form.
    3. Fill out the Microsoft account recovery form thoroughly
      The recovery form is the main way to regain access when security info (like recovery email) has been changed:
      • Provide a different, working email address you can access now; Microsoft will use it to contact you about the recovery request.
      • Answer as many questions as possible: old passwords, subject lines of recent emails, contacts you email often, folder names, etc.
      • Submit the form from a device and location you commonly used with this Hotmail account to improve the match.
      • Microsoft will review and respond, typically within 24 hours.
    4. If the account was hacked, follow the compromised-account steps
      Since the account was clearly compromised (folders renamed, recovery info changed), follow the hacked-account guidance once you regain access:
      • Run a full antivirus/malware scan on PCs/phones used with this account before changing anything else.
      • Change the password again to a strong, unique one.
      • Review account settings such as connected accounts, forwarding, and automatic replies to remove anything the hacker added.
    5. Update security info after access is restored
      When back in the account:
      • Go to the Microsoft account security page.
      • Add a new recovery email and/or phone number that only you control.
      • Remove the attacker’s recovery email.
      • Avoid changing all security info at once, because that can trigger a 30‑day restriction on changes.

    If the recovery form fails repeatedly and two-step verification was enabled with methods you no longer control, support agents cannot override or bypass security; only successful self-service recovery will restore access.


    References:

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.