Hacked Microsoft Account, Unknown Recovery Email and Complete Loss of Access

Question

I am writing because I am extremely frustrated and concerned about the complete lack of effective assistance I have received regarding my locked Microsoft account.

I have been a Microsoft user for many years, and this account is extremely important to me. My email, OneDrive, cloud files and other Microsoft services are all connected to it. I currently have no access to any of them.

Every time I attempt to sign in, I am asked to verify an email address shown as:

ma*****@fviainboxes.com

I do not recognize this email address. I have never knowingly created or used an @fviainboxes.com address, and I have no access to it. At the same time, Microsoft has informed me that unusual activity was detected on my account.

I have repeatedly followed Microsoft's instructions and completed the Account Recovery Form. However, Microsoft continues to tell me that the information I provide is insufficient to verify that I am the owner of my own account.

This has placed me in an impossible situation.

I cannot access my account because Microsoft wants to verify me through an email address that I do not recognize. I cannot change that verification information because I cannot access the account. I use the recovery procedure provided by Microsoft, but the automated system does not recognize me as the legitimate owner. When I seek further assistance, I am simply directed back to the same recovery process that has already failed.

Meanwhile, I have lost access not only to my email but also to my OneDrive and cloud files accumulated over the years.

I fully understand and appreciate Microsoft's need to protect customers' accounts from unauthorized access. However, a security system should also provide a meaningful way for a legitimate account owner to establish their identity when the automated process fails. At present, I feel that I am being locked out of my own digital life while being given no effective means of resolving the problem.

I am not asking Microsoft to bypass its security procedures. I am asking for my case to be reviewed by a person and for Microsoft to provide me with an alternative, secure method of proving that I am the legitimate owner of this account.

I am willing to provide historical information about the account and any other appropriate evidence required through a secure verification process.

Please do not simply refer me once again to the standard Account Recovery Form. I have already used it repeatedly, and that is precisely the process that is failing.

I urgently need assistance in recovering access to my Microsoft account, my email and, particularly, my OneDrive/cloud files.

I would be grateful if this matter could be escalated to the appropriate account security team and if I could receive a substantive response explaining what can be done in this situation.

Answer 1

Sorry to hear you're having trouble.

As well as the information already provided please be sure to contact your bank/credit card provider or any other payment method you may have on your account to let them know of the lost info so they can take other steps to prevent fraud on your account. In the meantime, if you do still wish to speak with support you can still do so via https://support.microsoft.com and click on Contact Us then follow the instructions provided. Please note though that they may not be able to help you recover the account.

Answer 2

If the attacker changed the email address, password, multifactor authentication and account recovery code - as any smart attacker will do within minutes of gaining access to an account - I'm genuinely sorry to tell you that there is no chance of getting the account back. There is nothing that Microsoft can do to help you, which is why they don't have anyone to talk to.

You might not want that account back, even if you could get it, because the attacker can use it to send spam and attack other computers, in your name. That account could be poison to your reputation.

What you must do now, and the sooner the better, is to take steps to prevent your identity from being misused on the internet. For example: Change all your passwords, tell your contacts not to open messages from your old address and cancel payment cards used with the account. The attacker knows everything about you that is in your account and will try to make use of it. Be on the lookout for signs that your identity has been stolen.

How to prevent this from happening again: There's nothing in the world that can guarantee that an account won't be stolen, but you can take steps to significantly reduce the risk. Your first step is to replace your passwords with passkeys where you can. (Not all websites offer passkeys yet.) Unlike a password, a passkey never leaves your device, so it can't be intercepted on the internet, stolen by malware or exposed in a data breach. Moreover, a passkey is not something you have to remember, so it can't be forgotten or phished.

Another important step is to keep yourself informed about the newest threats coming from the internet, so you won't fall victim to a scam. The people who create these scams are very professional about it, and they hire psychologists, marketing experts, graphic designers and engineers to assist them.

Finally - always have backup copies of the most critical information you store online, so you'll still have it in the event you lose access to your account.