Compromised Microsoft/Xbox account — original login (Gmail) removed by attacker and leaving family safety, requesting escalation

Question

My son's Microsoft account has been compromised. The attacker has:

1. Removed his original Gmail address as the account's primary alias/sign-in email
2. Changed the 2FA/recovery email to their own address
3. Removed the account from our Microsoft Family Group

I have direct evidence of ownership:

• Credit card charge: I personally paid for a Minecraft purchase made through this account on June 04, 2026 — I can provide the card statement/transaction reference as proof.
• Original sign-in email: <PII REMOVED by Moderator> @gmail.com
• [old password(s) ever used on the account: <PII REMOVED by Moderator>. device names previously used to sign in : DESKTOP-<PII REMOVED by Moderator>, Xbox gamertag :<PII REMOVED by Moderator>, Minecraft username : <PII REMOVED by Moderator>

Since the original email now shows 'This Microsoft account doesn't exist' when I try to sign in or use the recovery form, I understand this is because the alias was removed rather than the account being deleted. I'm requesting this case be escalated to the Account Recovery/Security team for manual ownership review, since the automated recovery form cannot validate an alias that's been removed.

Please let me know what additional proof you need — I'm ready to provide it immediately.

<Moved from: Outlook | Web | Outlook.com | Account management, security, and privacy>

Answer 1

Hi, Sharjeel Bin Afzal

I’m sorry this happened. Removing the original alias can make the account appear nonexistent, but this public forum cannot access accounts, verify payment records, or directly escalate a recovery case.

Here are some suggestions you can try:

Use the official Sign-in Helper first. It can provide the appropriate recovery steps and may offer an option to contact an agent for a compromised account.

If directed to the recovery form, complete it from a device and location previously used with the account. Provide old passwords, the frequently used Xbox console hardware ID, gamertag, Minecraft details, and accurate purchase information. Use a separate working email for replies.

If the original Gmail address is rejected, check Microsoft security-alert emails for clues about the changed alias, then explain clearly to the agent that the original alias was removed during the takeover.

Secure the Gmail account, payment card, and every other account that reused the same password.

Please be advised that this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, are not allowed to directly interfere with Microsoft product features or access back-end systems. Our role is limited solely to providing technical guidance on reported incidents, requests, or ideas.   

Thank you for your patience in reading, I hope this information has been helpful to you. 

---

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment."    

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.