Description of how I lost access to my email.

Question

I have the email the hacker planted or imposed and the one Microsoft lists as default email address to send a verification code, it is this one: [Removed PII] Does that alien email help in recovering my email or pinpoint the hacker in any way?

My real email address, phone number and password were deleted or removed or temporarily replaced by the hacker. I received 4 emails from Microsoft that seemed legit in my inbox and 2 in my Junk folder yesterday before my email was compromised. I saw no extrange word or letter in the email address, they seemed to have come indeed from Microsoft, the first ones read: -If it was you who tried to log in disregard this email.- The 4 emails in my Inbox read: -This email address will be removed, this phone number will be removed, and so on. I thought Microsoft was doing that for protection, now I see my account was hacked. I notice something weird when i attempted to send en email with attachments and I they could not be opened for visual verification once inserted in my email. I sent that email and another but they don't show under folder Sent. In my Iphone, when I check my email, the last one that shows is from Thursday, with no subject and no text, only this message: "This message has not been downloaded from the server."

Answer 1

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data. 

---

Hi @Rafell Enriquez

I’m sorry this happened. The unfamiliar email address is likely a recovery method or alias added by the attacker. Unfortunately, knowing it will not let you receive the verification code or identify the person behind the attack. Microsoft and forum members also cannot trace or disclose who owns that address.

Since your email, phone number, password, and verification methods were changed, please use Microsoft’s official hacked account recovery process. Start with the Sign-in Helper on that page. If directed to the recovery form, submit it from a device, browser, and location previously used with the account. Include old passwords, contacts, exact email subject lines, purchase information, and any other details only the account owner would know. Microsoft recommends providing as much accurate information as possible.

Before attempting recovery again, scan your computer for malware. Keep copies of the Microsoft security notifications, but do not post the unfamiliar address, your real email, phone number, recovery codes, or screenshots containing personal information publicly. Genuine Microsoft account notifications normally come from an address ending in @accountprotection.microsoft.com, although you should still access recovery pages directly rather than through email links.

The missing Sent messages and the iPhone download error do not identify the attacker. They may be related to the account no longer syncing correctly, but account access must be recovered first.

Please kindly note that Microsoft Community moderators cannot manually restore the account or replace its security information.

Answer 2

That alias does not provide a self-service way to identify the attacker or recover the account. The supported recovery path is to use the Microsoft account Sign-in Helper or the account recovery form. Support agents also cannot send password reset links or change account details.

The symptoms described match a compromised Outlook.com/Microsoft account:

• security info removed or replaced
• messages missing
• sent mail not appearing as expected
• possible mailbox manipulation

Recommended steps:

1. Check the account’s recent activity to review sign-ins and security challenges.
2. Run a full malware scan before changing the password. In Windows Security: Virus and threat protection > Scan options > Full scan > Scan now.
3. Change or reset the password after the scan.
4. Check account settings for unauthorized changes, especially connected accounts, forwarding, and automatic replies.
5. If sign-in is blocked or normal recovery options now point only to the attacker’s address, use the Sign-in Helper first. If needed, continue with the Microsoft account recovery form.
6. If two-step verification was enabled and none of the alternate verification methods are accessible, support cannot bypass that protection.

For suspicious Microsoft emails, a message from the Microsoft account team is trusted when the sender domain is @accountprotection.microsoft.com. Validity can also be checked by reviewing the message headers and confirming the account activity mentioned actually belongs to the account.

---

References:

• How to recover a hacked or compromised Microsoft account
• Help protect your Outlook.com email account
• Help with the Microsoft account recovery form
• Can I trust email from the Microsoft account team?
• Respond to a compromised cloud email account