Microsoft account hacked, attacker enabled 2FA and I cannot recover the account

Question

My Microsoft account was hacked. The attacker enabled two-factor authentication with their own authenticator app and added their own recovery email address.

I still know the original account information, old passwords, and I have access to the original Gmail account linked to it. However, the Microsoft recovery form is automatically rejected because 2FA is enabled.

Support chat and phone options are unavailable and every support page redirects me back to the recovery form.

Is there any way to escalate this case to a human recovery team or verify ownership another way?

I can provide old passwords, account history, purchases, and previous login information if needed.

Answer 1

There is no escalation path to bypass two-step verification for a hacked personal Microsoft account when the attacker has replaced the security info and enabled their own 2FA.

For consumer Microsoft accounts, all recovery is handled by the automated systems behind the account recovery and sign-in helper tools. Support agents are not allowed to reset passwords, turn off 2FA, or manually verify ownership for security reasons. If two-step verification is enabled and none of the configured verification methods are accessible, recovery is not possible.

The only supported options are:

1. Use the sign-in helper / hacked-account flow
   • Start with the hacked/compromised account guidance and sign-in helper: How to recover a hacked or compromised Microsoft account.
   • This will route through the appropriate self-service flows and, where applicable, offer contact options. However, these do not override 2FA requirements.
2. Use the account recovery form (if 2FA is not enabled or is still accessible)
   • When 2FA is not enabled, or when at least one verification method is still under the legitimate owner’s control, the Account recovery form can be used with as much accurate information as possible (old passwords, contacts, subjects, etc.).
   • Guidance for filling it out is in Help with the Microsoft account recovery form.
3. Understand the 2FA limitation
   • As documented: if two-step verification is turned on and none of the alternate verification methods are accessible, support cannot help. The automated system will reject recovery attempts, and agents cannot override this or verify ownership using extra information such as purchase history or old passwords.

Given the described situation (attacker enabled 2FA with their own app and changed recovery info, and the form is rejected because 2FA is on), the account is effectively unrecoverable under Microsoft’s current consumer-account security model. There is no separate “human recovery team” that can manually validate ownership or disable 2FA.

The practical next steps are:

• Treat the account as lost and move critical services, subscriptions, and contacts to a new, secured account.
• Inform contacts (from another email or channel) that the old account is compromised.
• For any linked services (for example, Minecraft or others), contact their respective support teams separately to see if they can help with service-side changes, as they may have their own processes.

---

References:

• How to recover a hacked or compromised Microsoft account
• Help with the Microsoft account recovery form
• My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
• Need help with hacked microsoft account - Microsoft Q&A
• My account got hacked. - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
• My account got hacked - Microsoft Q&A