a recovery email that isn't "on" the account

Question

So my account was hacked. A strange email address was added as the account codes are sent to. @bwkripest.com was the domain name. a VERY well known scammer haven. The scammer set up a pin. In which, I cannot reset. due to it apparently requiring a device key. Which I have never had. I've found a way to sign into my account. removed ALL emails, ect. but I have yet to see any email in my account with bwkripest.com.... So the account doesn't exist in ANY way shape or form in my sign in options or account sign in. Yet it constantly asks me to send codes to it and the pin revolves around it. WHY WON'T MICROSOFT DO THEIR JOB AND REMOVE IT? It's as though they want scammers to steal accounts. The only thing I cannot sign into and do anything with is the bwkripest.com email. yet that seems to be the only email address, they want to acknowledge. It's become absurd and ridiculous. Not to be rude, but someone needs to use a touch of common sense. If the only thing that has changed, is the random email address, and a new pin that is tied to said email address. OBVIOUSLY, that's the hackers. Holy crap!

Answer 1

Hello Thomas,

If you have already regained access to the account and removed the unfamiliar email address, but Microsoft still offers that address as a verification method, it may be a security/recovery method rather than an account alias. These are managed separately, so an address does not necessarily need to appear under your normal sign-in aliases for it to be presented during account recovery.

I recommend the following:

Secure the account first

Change your Microsoft account password from a trusted device.

  Review **Recent activity** for unfamiliar sign-ins.
  
     Remove any unfamiliar security information or authentication methods that are still listed.
     
        Enable your own trusted authentication method, such as Microsoft Authenticator or another available method.
        
        **Check the account's security information**
        
        Sign in to your Microsoft account and open the Security section. Check whether the unfamiliar address is listed as a verification method, alias, or other security information.
        
        **If the unfamiliar address is no longer listed but is still being offered during verification**, don't assume that the address still exists as an alias. Microsoft may be using previously registered security information as part of the account-recovery process.
        
        **Use Microsoft's account recovery/security support if you cannot remove it.**
        
        Because this involves a potentially compromised account and an authentication method you don't control, account-specific support will be required if the unwanted verification method remains attached after you've secured the account.
        

Also, avoid repeatedly attempting verification through the unfamiliar address. Do not provide anyone with verification codes, passwords, recovery codes, or device/security keys.

If you can post the exact screen/message that appears when Microsoft asks you to send the code (with the email address partially redacted), it would help determine whether Microsoft is treating it as a security method, alias, or another recovery mechanism.