Stolen Microsoft/Xbox Account

Question

Hi.

My son's Microsoft Account and associated Xbox profile have been stolen.

Within seconds of gaining access to my son's Microsoft account, they were able to remove the recovery email address and phone numbers associated with the account, disconnect the associated Microsoft Authenticator, remove it from my Microsoft family and change the alias of the email address to ******@outlook.com.

I've raised a recovery request, including my son's Gamertag and the Xbox Network Device Id, which came back confirming that unauthorised activity had occurred on the account and that the account has been suspended but cannot be recovered.

My son cannot access his Xbox profile on his console because the email address associated with his gamertag has been changed to ******@outlook.com and it's requesting a password before he can sign in.

Firstly, how is it so easy for someone to change every item of security associated with a Microsoft account, including the alias, so quickly.

Second, how do we recover the Microsoft account, or at the very least the Xbox Gamertag/profile?

.

[Moderator edit: Changed tags: Microsoft Security | Microsoft Authenticator ]

Answer 1

Hey there, Pete

Sorry to hear that your son’s Xbox/Microsoft account has been hijacked. It’s an awful situation to go through, especially when purchases and personal data are tied to the account. I want to be honest and set realistic expectations based on what we regularly see in the community.

Firstly, how is it so easy for someone to change every item of security associated with a Microsoft account, including the alias, so quickly.

In most cases, account hijacks are done using an automated bots. These bots know exactly which Microsoft security pages to target and can replace recovery information to block you from regaining access.

The most common method is fake “official” Discord servers. Attackers create servers that look like they’re from Xbox, Mojang, or Microsoft. When someone joins, they’re asked to “verify their Microsoft account” by entering their email and the security code sent to their device.

In reality, the bot is using that code to sign into the Microsoft account security page: https://account.live.com/proofs/manage/additional

That security page asks for a security code because you are accessing sensitive information. So when the user thinks they are 'verifying' their account for the 'official' server, they are actually providing the automated bot access to their Microsoft account.

Once the bot is in, it allows the user to enter the Discord server, which looks legit to the user. So the user most likely closes it and continues playing their game.

What they don't realise is, once the bot is in, it then does the following:

1. changes the security information for the Microsoft account first, replacing it with theirs,
2. Turns on two-step verification (if it hasn't been turned on before),
3. Replaces your usernames for the Microsoft account through this page: https://account.live.com/names/manage,

Some automated bots stop there, and some don't. Some continue to:

1. Delete all emails and folders on in your inbox,
2. Update all personal information and replace it with theirs,
3. Start removing any files on the account,
4. Start extracting what information it can such as passwords, addresses and other personal information they can sell.

Because the bot has a valid authentication token, it can move through the account without further challenges. All of this happens within minutes. long before the user realises anything is wrong.

Second, how do we recover the Microsoft account, or at the very least the Xbox Gamertag/profile?

This issue has been raised many times on the community, and Xbox created the recovery form in response to ongoing feedback that can be accessed here: https://aka.ms/recovermyaccount

However, once an attacker has fully replaced the security information, recovery is often not possible. We see this frequently on the community, and many of us have raised feedback that Microsoft should detect bulk security changes happening in a short timeframe.

I've raised a recovery request, including my son's Gamertag and the Xbox Network Device Id, which came back confirming that unauthorised activity had occurred on the account and that the account has been suspended but cannot be recovered.

I don't know what recovery form you have used. Unfortunately, if the team are unable to recover the Microsoft account, and have had to suspend it, then there is nothing more that can be done. I would argue though, there should be a way for them to transfer purchases from one account to another, but this is a feedback request.

You mentioned that your recovery request confirmed unauthorised activity and that the account was suspended:

confirming that unauthorised activity had occurred on the account and that the account has been suspended

When this happens, it usually means the attacker used the account for harmful activity (phishing, spam, etc.). As community members, we don’t have visibility into the suspension details.

If the recovery team has suspended the account and cannot restore it, then unfortunately there is nothing more we can do. I agree that there should be a way to transfer purchases to a new account, but at the moment this isn’t possible.

Hope this answers your question. I know it isn't an answer that you are expecting and I am sorry I can't bring better news to the thread.

If you would like help preventing this from happening in the future, please let me know and I will be happy to go through some tips on keeping your Microsoft account secure. Alternatively, this article may help on how to keep your account secure: https://support.microsoft.com/en-us/accounts-billing/manage/how-to-help-keep-your-microsoft-account-secure

Nathan

Answer 2

The supported recovery path for a personal Microsoft/Xbox account is limited to the official recovery tools.

1. Start with the Sign-in Helper.
   • This is the recommended first step before the account recovery form.
   • If the account has no two-step verification and the verification options are no longer recognized, this is the tool to use first.
2. Submit the Account recovery form again with as much detail as possible.
   • Use a device previously used to sign in to the account, and a familiar location such as home.
   • Provide a working email address that can receive the recovery result.
   • Include as much account-specific information as possible.
3. For Xbox-related recovery details, include:
   • the Xbox hardware ID from a console used frequently with the account
   • the Gamertag
   • old passwords that may have been used
4. For Microsoft account details, include any information that improves verification, such as:
   • exact Outlook.com or Hotmail.com email subject lines
   • names of contacts
   • older account details that may match what was entered when the account was first created
   • saved passwords from Edge or Windows Credential Manager, if available
5. If the form is rejected, it can be retried up to two times per day.
   • Recovery results are sent to the working email address provided in the form within 24 hours.
6. If two-step verification was turned on and none of the alternate verification methods are accessible, there is no supported recovery path through support.
   • Support agents are not allowed to send password reset links or change account details.
7. If the account was hacked, the documented cleanup steps after access is restored are:
   • run a full antivirus or malware scan before changing the password
   • change or reset the password
   • review connected accounts, forwarding, and automatic replies

For the Xbox profile access on the console, the available guidance in the provided material is tied to recovering the Microsoft account itself. No separate supported process is provided here for recovering only the Gamertag/profile independently of the Microsoft account.

The question about why all security details and the alias could be changed so quickly is not explained in the provided material.

---

References:

• Help with the Microsoft account recovery form
• How to recover a hacked or compromised Microsoft account