Microsoft Account Hacked – Account Recovery Impossible – Unable to Sign In or Update Account Information

Question

Hello,

My Microsoft account has been hacked, and I can no longer modify my account information.

Is there any way to recover my account other than by following the procedure described on the following website? https://support.microsoft.com/en-us/accounts-billing/manage/how-to-recover-a-hacked-or-compromised-microsoft-account

I can no longer sign in because:

• my primary email address and recovery email address have been changed;
• the recovery email address can only be changed every 30 days, which gives the attacker enough time to cancel any recovery attempt;
• I cannot use the account recovery process because my account information has been modified.

Here is the information I still have to prove my identity:

• one of my previous passwords;
• my full name, along with the information available in my account history;
• my Windows sign-in history on my PC.

This information was previously sufficient to recover my account. However, since so much of my account information has been changed, I can no longer complete the recovery process. In addition, the recovery process does not allow me to remove the recovery email address added by the attacker before the 30-day waiting period expires.

I also have the following information that demonstrates suspicious activity and confirms that I was locked out of my account:

• the approximate time when my email address and account information were changed;
• the appearance of a new device signing in from an unusual location, which I am no longer able to remove from my account;
• the date of the compromise and its source: a compromised executable (.exe) file)

Could you help me, please? Thanks for your time.

Answer 1

Hello @Nebulis

I'm sorry to hear about your situation.

If this is a personal Microsoft account (Outlook.com, Hotmail.com, Live.com, Xbox, etc.), the recovery options are unfortunately limited to Microsoft's official account recovery process. There is no alternative process that Microsoft Support or the Microsoft Q&A community can use to bypass the security checks or manually restore access to the account.

Based on your description, I recommend the following:

• Continue with the Account Recovery Form (ACSR) if you haven't already: https://account.live.com/acsr
  • Complete the form from a device and location you've previously used to access the account, as this may improve the likelihood of successful verification.
• If the attacker changed your security information, review Microsoft's guidance on recovering a compromised account:
  • https://support.microsoft.com/account-billing/how-to-recover-a-hacked-or-compromised-microsoft-account
• If you still have access to any trusted devices or Microsoft services associated with the account (such as an Xbox console or a Windows PC signed in with that account), mention this when working through the recovery process, as it may help establish account ownership.
• Since you indicated the compromise originated from a malicious executable, ensure that all of your devices are cleaned before attempting recovery. Run Microsoft Defender Offline or another trusted antivirus solution, install the latest security updates, and change the passwords for any other accounts that may have been affected.

Unfortunately, knowing previous passwords, the approximate compromise time, or having Windows sign-in history does not allow Microsoft moderators on this forum to recover the account. The account recovery team relies on the automated verification process to protect customer accounts, and they cannot override the ownership validation requirements.

To better understand your options, could you clarify:

• Is this a personal Microsoft account (Outlook.com, Hotmail.com, Live.com), or is it a work or school account managed by an organization?
• Did you ever enable two-step verification (MFA) before the account was compromised?

If the account is a work or school account (Microsoft Entra ID) instead of a personal Microsoft account, the recovery process is different, and the appropriate IT administrator or Microsoft 365 administrator should be involved.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.