How to win against a hijacker for my microsoft account

Question

I need help. I accidentally sent my microsoft 6 digit code to a hijacker through discord because of a minecraft scam. I already filed in a request for a new security info to let my microsoft account go back to me. Though the hijacker probably can still cancel this request. What should i do? Microsoft doesn't accept my request for account recovery due to my lack of info

Answer 1

I'm sorry to say: You can't win against an attacker who has stolen your account. If the attacker has changed the account's username, password, MFA authentication and recovery information like your phone number - and unless your attacker is a complete amateur they did all that within the first minutes of the attack - you will never get your account back.

Instead, you need to worry about what mischief or worse the attacker can do with all the information about you in your account, which is now in their possession, and quickly take steps to protect your identity.

Answer 2

Hey there! Nice to meet you!

Since you mentioned that you were able to request a security info change, you will need to wait for the 30-day restriction state to complete; but if the hacker has their email added, having them in full control over your account, they can simply cancel your security info change request.

If this happens, you will need to try requesting again, and hopefully, the hacker will not notice.

Unfortunately, it is also not possible to bypass the 30-day restriction state.

However, if the 30-day restriction state is complete, you will be able to remove the hacker's security info email from your account using your newly added security info.

In case the hacker is able to cancel your security info change request, reset the password, and since the security info has been replaced, I'm afraid there is no other working method to recover the Microsoft account, and Microsoft Support cannot help either.

Thank you for your understanding.

Best regards,

Darhyl

Answer 3

Follow these steps immediately to maximize the chance of keeping or regaining control of the Microsoft account:

1. Run malware and security checks

• On the Windows 11 device, make sure Windows Security (Defender) is up to date and run a full scan to ensure there is no malware or remote-control software installed, as recommended in the hacked-account guidance.
• Keep Windows updated with the latest security updates.

2. Try to sign in and secure the account

• If it is still possible to sign in, immediately change the password using the official path from the hacked-account article after confirming the device is clean.
• Then review account security settings (connected accounts, forwarding, automatic replies) to ensure nothing malicious is configured.

3. Check if a “security info change is still pending” banner appears

• Sign in to the Microsoft account Security page (if still possible).
• If the message “Your security info change is still pending” or “You can’t access this site right now” appears, this means all previous security info was removed and replaced and the account is in a 30‑day restricted state.

4. Use the correct action on the pending-security-info screen On the “Your security info change is still pending” window:

• If the security-info removal was done by the hijacker (not by you), select the let us know link at the bottom of that window and follow the prompts. This routes through the “unauthorized change” flow and is the supported way to report that the change was not made by the account owner.
• If at any point you had removed the security info yourself and still have access to the old proofs, you can instead select cancel this request and follow the prompts. This requires access to the existing security proofs.

5. Understand the 30‑day restriction

• When all security info is removed, the account is placed in a restricted state for 30 days to protect against hijacking.
• During this period, most services can still be used, but sensitive actions (changing password, parental controls, aliases, payment options, OneDrive vault) are blocked.
• If two-step verification was enabled, access is more restricted; the options are to wait the 30 days or successfully cancel the pending request from the security-info screen.

6. Use the official hacked-account recovery flow

• Use the official “How to recover a hacked or compromised Microsoft account” flow. It includes a sign-in helper that will either provide self-help steps or options to talk to an agent.
• Follow the steps in order: scan for malware, change/reset the password, and then review account settings.

7. If recovery requests are rejected

• The account recovery form is automated and relies on matching information (old passwords, usage details, etc.). If the form is repeatedly rejected and the hijacker has replaced the security info, moderators indicate there may be no further method to recover the account.
• In that case, continue to monitor any other accounts (email, banking, social media) that might have reused the same password and secure them by changing passwords and enabling stronger authentication.

8. Prevent future incidents

• Avoid sharing verification codes with anyone, even if they claim to be support or part of a game or service.
• Add multiple, up-to-date security options (phone, alternate email, authenticator app) once access is restored, and avoid changing all security info at once.
• Consider using an authenticator app or other passwordless methods to strengthen sign-in.

---

References:

• How to recover a hacked or compromised Microsoft account
• What does “Security info change is still pending” mean?
• Microsoft account has been locked
• Common problems with two-step verification for a work or school account
• Protect yourself from tech support scams
• My account got hacked. - Microsoft Q&A
• My account got hacked - Microsoft Q&A
• my microsoft account has been compromised - Microsoft Q&A
• Need help with hacked microsoft account - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A