Microsoft Account Hacked? How to Recover and Secure It

For Microsoft account recovery after a hack, start at the Microsoft sign-in page and choose the forgotten password option. If your security info still works, you’ll get a code and can reset the password. If the attacker changed your security info, use Microsoft’s official account recovery form, filling it in from a device and location you’ve used before. Once you’re back in, change the password, review recent activity, remove unknown security info, and check Outlook for forwarding and inbox rules.

A Microsoft account is often the key to much more than email. It can control Outlook.com or Hotmail, OneDrive files, Xbox purchases, Microsoft 365 subscriptions and sign-in to Windows itself. That’s why it’s worth working through every step below, not just the password.

Signs your Microsoft account has been hacked

• An email or notification about unusual sign-in activity, or a security info change you didn’t make.
• Your password stops working.
• Contacts say they’ve received strange emails from your Outlook or Hotmail address.
• Emails in Sent Items you didn’t write, or messages disappearing from your inbox.
• Purchases, subscriptions or Xbox activity you don’t recognize.
• Files in OneDrive that have been deleted, changed or shared with people you don’t know.

Some “unusual activity” emails are themselves phishing. Don’t click links in them. Instead, go to your Microsoft account directly by typing the address into your browser, then look at the security section and recent activity.

If you can still sign in: secure the account now

1. Change your password to a long, unique one you haven’t used anywhere else.
2. Review recent activity. In the security section of your Microsoft account, check the recent sign-in activity. If you see sign-ins you don’t recognize, Microsoft lets you mark them as not you, which prompts further security steps.
3. Check your security info. Look at the phone numbers, email addresses and authenticator apps listed for verification. Remove any you don’t recognize and make sure yours are there.
4. Sign out of other sessions. Microsoft’s advanced security options include a way to sign out of your account on other devices and browsers. Use it after changing the password.
5. Turn on two-step verification or passwordless sign-in with the Microsoft Authenticator app or a passkey. Save the recovery code Microsoft gives you somewhere safe and offline.
6. Review app permissions. Check which apps and services have access to your account and remove anything you don’t use or don’t recognize.

If you’re locked out: Microsoft account recovery step by step

If the attacker changed your password, you can still recover the account through Microsoft’s official process.

1. Try the password reset first. On the sign-in page, enter your email address or phone number and choose the forgotten password option. If a code can still reach your phone or alternate email, use it to reset the password.
2. If none of your security info works, choose the option to say you don’t have access to any of these. Microsoft will take you to its account recovery form.
3. Give a contact email you can check. The form asks for an email address, different from the hacked one, where Microsoft can reach you. If you don’t have one, create a free one for this purpose.
4. Answer as fully and accurately as you can. The form may ask for old passwords, the names on the account, your date of birth, email subjects and contacts you’ve written to, and details from other Microsoft services you use, such as Xbox. Partial answers are better than blanks.
5. Fill it in from a familiar device and location, such as the home computer and Wi-Fi you normally use. That helps Microsoft recognize you.
6. If the request is declined, you can try again with more information. Search through old receipts, emails in other accounts and notes to jog your memory before resubmitting.

Microsoft’s support agents can’t bypass the recovery form or verify your identity for you over chat or phone. The form is the route. That also means anyone claiming a special back channel is not being honest with you.

Work or school accounts are different

If the hacked account belongs to your employer or school, such as a Microsoft 365 account with your company’s email domain, the recovery steps above don’t apply. Contact your organization’s IT or help desk straight away. They control the account, can reset it, and need to know quickly in case the attacker is using it to reach colleagues or customers.

If a hacked work account is being used to send messages to customers, our guide on business accounts that have been hacked covers the communication side.

Check what the attacker may have left behind

Once you’re back in, look for changes that let an attacker keep watching or cause more harm.

Where	What to check	What to do
Outlook.com mail settings	Forwarding to an address you don’t know	Turn forwarding off or remove the address
Outlook.com rules	Rules that delete, move or forward messages, often ones mentioning “bank”, “security” or “password”	Delete any rule you didn’t create
Outlook.com signature and automatic replies	Links or messages added by the attacker	Remove them
Sent Items and Deleted Items	Messages sent in your name	Note who received them so you can warn them
OneDrive	Deleted files, changed files, new sharing links	Check the recycle bin, restore what you can, stop sharing links you didn’t create
Payment options and order history	Purchases, new cards, subscriptions	Remove unknown payment methods, report purchases to Microsoft support and your bank
Xbox	Gamertag changes, purchases, friends and messages	Change what you can and report fraudulent purchases
Devices	Devices listed on your account that aren’t yours	Remove them

OneDrive keeps deleted files in its recycle bin for a limited time, and Microsoft 365 subscribers may have an option to restore OneDrive to an earlier point. Check your plan’s help pages if files were deleted or encrypted.

A worked example

This is an illustrative scenario, not a real client.

Tom notices his Hotmail password no longer works. A friend then texts to ask why he sent a link to a “shared invoice.” Tom’s recovery phone number has been changed, so the reset code doesn’t reach him.

• He uses the recovery form on his home laptop, giving a new Gmail address as his contact email. He lists the last two passwords he remembers, three contacts he emails often, and a few recent subject lines.
• Microsoft emails him a reset link at the new address. He resets the password and immediately signs out of other sessions.
• He removes the attacker’s phone number from his security info, adds his own, and turns on two-step verification with the Authenticator app.
• In Outlook’s settings he finds a rule moving any email containing “security” to Deleted Items, and a forwarding address. He deletes both.
• He checks his order history, finds an unfamiliar Xbox gift card purchase, removes the stored card, and reports it to Microsoft and his bank.
• He emails his contacts to say the invoice link was not from him and they shouldn’t open it.

Without the settings check, the attacker would have kept receiving copies of his mail and hidden Microsoft’s own security alerts from him.

Protect the accounts linked to your Microsoft account

If your Microsoft email is used for password resets elsewhere, an attacker who controlled it could have reset other accounts too.

• Change passwords on important accounts that use this email, starting with banking, other email accounts and social media.
• Change any password you reused. If the Microsoft password was used anywhere else, change it there too.
• Check those accounts’ security settings for new devices, recovery details or forwarding.
• Watch for identity theft signs. If the attacker saw scans of documents, tax forms or financial records in your mail or OneDrive, follow our guide on what to do if your identity is stolen.

If you also use Gmail, our Gmail hacked guide covers Google’s version of these steps.

How to stop it happening again

• Use a unique password stored in a password manager, or go passwordless with the Authenticator app or a passkey.
• Keep two-step verification on and keep your recovery code somewhere safe.
• Keep security info current. An old phone number or dead alternate email makes recovery much harder.
• Never approve a sign-in request you didn’t start. Attackers sometimes send repeated prompts hoping you’ll tap approve.
• Be wary of pop-ups and calls. Fake Microsoft support pop-ups that say your computer is infected and give a phone number are a common scam.
• Ignore extortion emails claiming the sender has your password or webcam footage. They’re usually built on old breach data. Our guide on the “you’ve been hacked” email scam explains how to tell.

Common mistakes

• Changing the password and stopping there. Forwarding and rules can survive a password change.
• Calling a number from a pop-up or search ad. Scammers pose as Microsoft support.
• Submitting the recovery form with blank answers. Take time to gather old passwords, contacts and subject lines first.
• Using the hacked address as your contact email on the recovery form. Use a different address you can check.
• Deleting the account in frustration. You could lose access to files, purchases and every service that uses it for sign-in.

When a hack becomes harassment or a reputation problem

Sometimes an attacker uses a hacked account to threaten you, leak private files or post content in your name. If you’re being threatened or extorted, report it to the police and see our help resources for organizations that support people facing online abuse. If leaked material or messages sent in your name are now showing up in search results or on social media, our personal reputation management service can help with removal requests and the wider cleanup. We’ll be honest about what can be removed and what can only be answered.

Frequently asked questions

How do I recover my Microsoft account if the hacker changed my phone number?

Use the forgotten password option on the sign-in page, then say you don’t have access to your security info. Microsoft will take you to its account recovery form. Give a different email address for contact, answer as fully as you can, and fill it in from a device and location you’ve used before.

Can Microsoft support recover my account over the phone?

Microsoft’s support agents generally can’t bypass the recovery process or verify your ownership for you. The official recovery form is the route for personal accounts. Be very wary of anyone claiming they can recover it another way.

What if my Microsoft account recovery request is rejected?

You can try again. Gather more information first, such as older passwords, exact email subject lines, contacts you’ve emailed and details of other Microsoft services you use, and submit from your usual device and network.

Is my Windows PC compromised if my Microsoft account was hacked?

Not necessarily. A hacked account doesn’t mean malware is on your computer. But if you sign in to Windows with that account, change the password, check your devices list, and run a security scan with your antivirus to be safe.