If the attacker changed the sign-in email and security information, recovery is limited to Microsoft’s official account recovery process.
What can still be done:
- Scan the PC for malware before changing anything else
- Open Windows Security.
- Go to Virus and threat protection.
- Select Scan options > Full scan > Scan now. This matters because Microsoft recommends clearing malware before changing passwords.
- Use the hacked account recovery flow
- Start here: Start
- If the account can still be recognized, follow the guided recovery steps.
- If the password is known but security info is lost
- Sign in to Advanced security options: Sign in
- Select Add a new way to sign in or verify.
- Confirm the new method with the code sent to it.
- Remove the compromised security method.
- Do not replace all security info at once, because the account may be restricted for 30 days.
- If access to all security info is lost
- Begin sign-in: Sign in
- At Verify your identity, select I don't have any of these.
- Follow the prompts to replace security info.
- After replacement, there is a 30-day wait before sign-in is allowed.
- If the password is not known and security info is gone
- Read: Help with the Microsoft account recovery form
- Submit: Recover account
- If possible, complete the form from a device and location previously used for that account.
Important limits from Microsoft:
- If two-step verification was enabled and there is no access to any alternate verification method, support agents cannot reset the account or change account details.
- Microsoft support agents are not allowed to send password reset links or manually change account security details.
- If the attacker changed the associated email/security details, and the official recovery process fails, community guidance in the provided material indicates the account is often no longer recoverable.
For the screenshot shown:
- The unfamiliar verification address indicates the attacker likely changed the account’s security info.
- In that state, the correct path is the official recovery flow above, not proof submitted in forum posts.
What information is specifically useful in the recovery form from the provided guidance:
- Previous passwords.
- Completing the form on a previously used device and from a familiar location.
- Any saved passwords that can be retrieved from browser or credential storage, if available.
If sign-in is no longer possible, the next official options are:
- How to recover a hacked or compromised Microsoft account
- Troubleshoot Microsoft verification code issues
- Help with the Microsoft account recovery form
- Microsoft account security info & verification codes
- Can I trust email from the Microsoft account team?
- I have proof that it is my account but my password and username (sign in email) were changed - Microsoft Q&A
- My account got hacked - Microsoft Q&A
- My account got hacked and the hacker changed the email. How can i get it back? - Microsoft Q&A
- MIcrosoft account compromised, MInecraft account stolen, email alias changed. - Microsoft Q&A
- Need help with hacked microsoft account - Microsoft Q&A