Child Microsoft account taken over and sign-in alias changed

Question

Hello,

I am seeking assistance regarding what appears to be a takeover of my son's Microsoft account.

The original account email was: ******@icloud.com

Around 25 May 2026, we received Microsoft emails containing a one-time security code and another notification stating that security information/passkey had been removed from the account.

After that, the following changes occurred:

The original email address is no longer recognized by Microsoft.

Both sign-in and password recovery state that the account does not exist.

The account now appears under a different email address: ******@gmail.com.

The account profile name changed.

The account country/region changed to Moldova.

Unknown two-factor authentication is now enabled.

Minecraft Java Edition and other purchased games linked to the account can no longer be properly accessed.

The account is still connected to the same Windows PC.

The account still appears in my Microsoft Family group, but under the new email address.

I am the parent and Family Organizer. We still have access to the original iCloud email account and copies of the Microsoft security notification emails.

Could a Microsoft moderator please advise how to recover an account where the original sign-in email appears to have been removed and replaced by another email address?

Thank you.

Answer 1

Account recovery is an online automated process, even if you are able to contact Microsoft Support, they cannot recover your account, they can only refer you to the account recovery form.

This forum is just a user to user account and no-one here has any account access, I wish I had better news,, when a Microsoft account is hacked, if the hackers change the associated data like the Email, then that account is usually no longer recoverable, try using the process they provide on this link to recover a hacked account, if this process is not successful, sadly, that account cannot be recovered.

https://support.microsoft.com/en-us/account-billing/how-to-recover-a-hacked-or-compromised-microsoft-account-24ca907d-bcdf-a44b-4656-47f0cd89c245

Answer 2

For a personal Microsoft account that has been taken over and had its sign‑in alias, country/region, and security info changed, recovery is handled only through the standard self‑service flows. Support and moderators cannot directly restore or edit the account; they can only direct to these tools.

Given the symptoms described (original alias no longer recognized, new alias on the same account, 2FA enabled by attacker, region changed), the following options exist:

1. Confirm whether the original email is still a Microsoft account
   Use the check described here:
   • Go to the Microsoft account sign‑in page at https://account.microsoft.com and enter the original iCloud address.
   • If the message shown is "We couldn't find an account with that username" or "That Microsoft account doesn't exist", then that address is no longer a Microsoft account or may have been closed.
   • If a password prompt appears, it is still a Microsoft account and the password‑reset/recovery flows apply.
   Details: How to check if your email address is a Microsoft account.
2. If the original address is not recognized at all
   This matches the behavior described in the context where a username stops working:
   • Try the Recover your account flow with any other alias or phone number that might still be associated with the account: Recover your account.
   • Ensure the domain and spelling are correct (for example, .com vs .co.uk, and name variants such as rachel vs rachael).
   • If all attempts still show "We couldn't find an account with that username", the guidance is to contact support using the dedicated contact path for this scenario.
   See: My username and password have stopped working.
3. If the account is in a “security info change pending” state
   Because security info and passkey were removed and replaced, the account may be in the 30‑day restricted state:
   • When signing in, if the message "Your security info change is still pending" or "You can't access this site right now" appears, it means all previous security info was removed and replaced, and the change is in a 30‑day pending period.
   • During this period, the account is restricted to protect against unauthorized changes.
   • From that pending screen, use whichever of these options is shown:
     • Cancel this request (only if the family still has access to the original security info and initiated the change).
     • Let us know (if the change was not made by the family; this routes through the unauthorized‑change flow on that same screen).
   Explanation: What does “Security info change is still pending” mean?.
4. If the attacker changed aliases and 2FA and the account cannot be verified
   The Q&A guidance for hacked accounts where the attacker changed aliases and security info is:
   • Use the official “How to recover a hacked or compromised Microsoft account” article and follow the steps, including the account recovery form.
   • Fill out the account recovery form as completely and accurately as possible. This is an automated ownership‑verification process; even support agents and moderators cannot bypass it or manually restore access if the form fails.
   • If the attacker changed the sign‑in alias and enabled 2FA, and the recovery form cannot verify ownership, the account is usually no longer recoverable.
   This is reflected in the moderator guidance: when hackers change associated data like email or enable 2FA, and the automated recovery process fails, the account generally cannot be recovered and neither forums nor support can override that. See:
   • Help with the Microsoft account recovery form
   • Q&A guidance in: Account hacked - Microsoft Q&A and How do I send an email to Microsoft about my account being hacked and taken over… (moderator answers explain that recovery is automated and may not be possible if the attacker changed aliases and 2FA).
5. If any access is still possible via the new alias
   If sign‑in is possible using the new Gmail alias (even partially), the recommended steps are:
   • Go to Manage how you sign in and remove any attacker‑added sign‑in aliases that are not recognized.
   • After regaining control, add a secure verification method (for example, Microsoft Authenticator or another trusted email/phone) and review all security info.
   This pattern is described in the Q&A answer My account got hacked.
6. If verification codes go only to attacker‑controlled methods and no access is possible
   When all verification methods (email/phone/2FA) are controlled by the attacker and the family cannot pass the automated recovery checks, the guidance from moderators is that the account cannot be recovered. In that case:
   • A new Microsoft account must be created.
   • Purchases (including Minecraft Java Edition) tied to the unrecoverable account cannot be moved if ownership cannot be proven through the automated tools.
7. Family organizer status and the connected PC
   The fact that the account still appears in the Microsoft Family group and is connected to the same Windows PC does not give additional recovery capabilities beyond the official account‑recovery and security‑info flows above. Family organizer permissions do not allow overriding account‑level security or reversing an alias/security‑info change.

In summary, for an account where the original sign‑in alias was removed and replaced, and 2FA and region were changed by an attacker, the only supported recovery path is:

1. Confirm whether the original alias is still a Microsoft account.
2. Use the Recover your account flow and, if applicable, the security info change pending options.
3. Complete the account recovery form with as much accurate detail as possible.
4. If all of these fail and the automated system does not restore access, the account (and its attached purchases) is treated as not recoverable.

---

References:

• Help with the Microsoft account recovery form
• Change the email address or phone number for your Microsoft account
• Help with "phone number is already used" in a Microsoft account
• After I changed my primary alias on my outlook.com account, I can't log back in
• My username and password have stopped working
• How to check if your email address is a Microsoft account
• How to add an email address or phone number to your Microsoft account
• What does “Security info change is still pending” mean?
• Account hacked - Microsoft Q&A
• My account got hacked. - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
• Please confirm my e mail address as <removed PII>@outlook.com - Microsoft Q&A
• MSN email issues - Microsoft Q&A