When all security info on a Microsoft account (password, recovery email/phone, 2‑step verification methods) has been changed and the attacker controls those methods, recovery is handled only by automated systems. Support agents are not allowed to override those systems, reset passwords manually, or bypass missing/changed security info, even if the changes were made by a hacker.
If the attacker has replaced the security info and the automated checks cannot confidently verify ownership from the data provided, the systems will deny recovery. This is why the response stated the account cannot be returned, even though the changes were not made by the legitimate owner.
The only supported options are:
- Use the official hacked-account/sign‑in helper
- Use the Microsoft account recovery form (if available for the account)
- Follow the guidance in Help with the Microsoft account recovery form.
- Submit the form from a device and location commonly used with the account.
- Provide as much accurate detail as possible (old passwords, approximate creation date, contacts, subject lines, etc.).
- If the form is declined, it can be retried with improved information, but if it repeatedly fails, there is no manual override.
- If security info was fully replaced and 2‑step verification is on
- As noted in the recovery-form article, if 2‑step verification is enabled and none of the verification methods are accessible, support cannot help and the account cannot be recovered. This is a hard security limit designed to protect account contents.
If these automated paths have already been tried and the result was that the account cannot be recovered, there is no further escalation path for consumer Microsoft accounts; support cannot “force” a recovery in this situation.
References: