Hacked Microsoft Account: How to Recover It (2026)

Quick answer: Start with Microsoft's sign-in helper at aka.ms/sign-in-helper. It asks for your email address or phone number and shows what to do next. Microsoft's hacked-account page says to scan your PC for malware first, then change or reset your password, then check your account settings. If you cannot get in, Microsoft has an account recovery form.

A Microsoft account covers Outlook.com and Hotmail email, OneDrive, Xbox and Microsoft 365, so a takeover can reach a lot. Everything below comes from Microsoft's own help pages.

What to do in 3 steps

1. Scan your PC for malware before you change your password. Microsoft says to make sure your antivirus is running and up to date and to run a full scan first. In Windows Security, open Virus and threat protection, then choose Scan options, then Full scan, then Scan now.
2. Change or reset your password. If you can sign in, change it at account.microsoft.com/security using Change password. If you cannot sign in, reset it (see below). Use a strong password you do not use anywhere else.
3. Check your account settings. Microsoft says it reset some settings because someone else had access. Check your connected accounts, mail forwarding and automatic replies.

If you can still sign in: secure the account now

• Check Recent activity. Microsoft's Recent activity page shows when and where your account was used in the last 30 days. If an Unusual activity section appears, open each item and choose "This was me" or "This wasn't me".
• Sign out everywhere. Sign in to the Advanced security options on your Microsoft account security dashboard, scroll to Sign out everywhere and select Sign out. Microsoft says you are signed out of browsers and apps within 24 hours, except on an Xbox console, which you must sign out of separately.
• Review your security info. At account.microsoft.com/security, select Manage how I sign in, and check every email address and verification method listed. You can add up to 10 ways to verify sign-in. Microsoft says the option to add a phone number may not be available, and you may only see an email address, an authenticator app or a passkey.
• Turn on two-step verification. On the same page, under Additional security and Two-step verification, choose Turn on. Microsoft warns that if you then lose your contact methods, it can take 30 days to regain access, so it recommends having three pieces of security info on the account.

If you are locked out but have your email or phone

1. Go to the Microsoft account sign-in page, enter your username and select "Forgot password?" (it may read "Forgotten your password?").
2. Choose where Microsoft should send a verification code. Retype the first part of the email address or the last four digits of the phone number it shows, then select Get code.
3. Enter the code, then type a new password.
4. If you do not see a place to send a code, you no longer have access to any of the options shown, or you do not recognise them, Microsoft says to use the sign-in helper tool.

If you turned on two-step verification, Microsoft says you will receive two codes instead of one when you reset your password. If you created a 25-digit account recovery code earlier, Microsoft explains how to use it on its recovery code page.

If the attacker changed your password or security info

• Use the sign-in helper first. Microsoft says the account recovery form takes time to fill in, so try the sign-in helper first. Microsoft says the tool either shows self-help or offers the chance to talk to an agent.
• Microsoft's unusual sign-in page also says that if someone may have changed your password, you can select "Forgot my password" on the sign-in page and then "I think someone else is using my Microsoft account", and follow the instructions.
• Then the account recovery form. Microsoft's page, Help with the Microsoft account recovery form, links to the form and explains it. You need a working email address that you can access. It can belong to a friend or relative, and Microsoft uses it only to contact you about the form.
• The form asks questions only you should be able to answer, such as contacts, email subject lines and old passwords. Microsoft says to answer as many as you can, and that guessing is fine because wrong answers do not count against you. If you can, fill it in on a device you used before, from a place you normally use it, such as home.
• Microsoft says it emails the result to your working address within 24 hours. If it could not verify you, you can try again, up to two times per day. If it verified you, it emails instructions to sign back in.
• If you see "Your security info change is still pending", all the security info on your account was replaced and the account is restricted for 30 days. If you did not make the change, Microsoft says to sign in at account.live.com/proofs/Manage and select the link "let us know". Microsoft says it cannot speed up the 30 days unless the request is cancelled.

If the account is locked or suspended

Microsoft says a locked account usually means activity that might break its Terms of Use. To unlock it, sign in at account.microsoft.com; if you cannot sign in, Microsoft says to use the sign-in helper. If you do not see the "Let's prove you're human" option, select the link in the window that begins with aka.ms/ and complete the account reinstatement form. Microsoft says a Microsoft Online Safety support agent reviews it and contacts you by email, and that sending extra requests may slow the reply. If your recovery request was not granted, Microsoft's "Account recovery unsuccessful" page repeats the two tries a day limit.

After you are back in

• Look at your sent mail and any posts or messages you did not send, and tell your contacts not to trust anything sent in your name.
• Check your Recent activity page again, and re-check connected accounts, forwarding and automatic replies.
• If your email account was also taken over, secure that too, and check any other accounts that use the same password.
• If money was taken, see what to do right after a scam and report it to your bank and to the police.

Warning: fake "recovery" services and fake Microsoft support

Do not pay anyone who offers to get your account back, and do not let anyone who contacts you take control of your PC. Microsoft says it never proactively contacts you with unsolicited PC or technical support. It says genuine Microsoft error messages never include a phone number to call, and that Microsoft will never ask for your password by email. Microsoft says a genuine unusual sign-in alert comes from the address [email protected], and that if you are unsure, you can sign in to your account directly without clicking links in the email. To see how fund-recovery fraud works, read The Second Scam. Microsoft has a page to report technical support scams.

If you are being threatened or blackmailed

If someone with access to your photos, files or messages is threatening to share them, do not pay. See our sextortion and blackmail guide and report it to the police.

If it is a child's account

If the account belongs to a child or teenager, ask a parent or trusted adult to help. The Microsoft pages we read do not describe a separate recovery route for children, so the steps above apply.

What Microsoft does not promise

Microsoft says that if you turned on two-step verification and cannot use any of your verification methods, it cannot help. It says its support agents are not allowed to send password reset links or to access and change account details (its locked-account page makes one exception: when you submit the account reinstatement form). Its pages do not guarantee that the recovery form will succeed.

We checked the steps against Microsoft's own help pages on 26 October 2026; menus change, so follow the on-screen prompts if they differ.

Sources

• How to recover a hacked or compromised Microsoft account
• Help with the Microsoft account recovery form
• Account recovery unsuccessful
• Microsoft account sign-in helper
• Reset a forgotten Microsoft account password
• How to get a Microsoft account recovery code
• Microsoft account has been locked
• What does "Security info change is still pending" mean?
• How to sign out of your Microsoft account everywhere
• What is the Recent activity page?
• What happens if there's an unusual sign-in to your account
• Microsoft account security info & verification codes
• How to use two-step verification with your Microsoft account
• Avoid and report Microsoft technical support scams
• How to help keep your Microsoft account secure

If you have been targeted, you are not alone. See our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.