Secure a Hacked Microsoft Account: Step-by-Step

If you suspect your Microsoft account has been compromised, acting quickly is critical. This guide walks you through the exact steps to regain control, secure your account, and prevent future unauthorized access. You will need access to the email address or phone number associated with the account, or the ability to use Microsoft’s account recovery form if you are locked out.

What You’ll Need

Access to the recovery email or phone number on your Microsoft account (if you still have it).
A device you trust (your own computer or phone) with an updated browser.
A second device or a printed list of your recent passwords (if you remember them, they help prove ownership).
Patience: Microsoft’s recovery process can take up to 30 days in the worst cases.

Step-by-Step

Go to the Microsoft account recovery page. Open your browser and navigate to account.live.com/acsr. This is the official security recovery page. Do not use links from emails or messages, as they could be phishing attempts.
Enter your compromised email address. Type the full email address (Outlook.com, Hotmail.com, Live.com, or a custom domain) and complete the CAPTCHA. Click “Next.”
Choose how to receive a security code. Microsoft will show the recovery options you previously set up (like an alternate email or phone). Select one and click “Get code.” If you no longer have access to any of these, click “I don’t have any of these” to proceed to the account recovery form.
Enter the security code. Check your alternate email or phone for the code from Microsoft. Enter it and click “Next.” You will then be prompted to create a new, strong password. Use at least 12 characters, mixing upper and lowercase letters, numbers, and symbols. Avoid reusing any previous password.
If you are locked out, fill out the recovery form. When you click “I don’t have any of these,” you will be asked for the account email and then presented with a long form. Provide as much detail as possible: the subject lines of recent emails, names of contacts you email often, your name and birthdate, and any previous passwords you can recall. The more accurate this information is, the faster the review.
Check your email for the recovery link. Microsoft will send a link to the alternate email address you provided on the form. This link is valid for 30 days. Click it to see the status of your request. If approved, you will get a link to reset your password.
Sign in and immediately sign out everywhere. Once you have your new password, sign in at account.microsoft.com. Go to “Security” > “Sign-in activity” and review the list. Look for any logins from unfamiliar locations or devices. Then, go to “Security” > “Password security” and click “Sign me out everywhere.” This revokes all existing sessions, including the attacker’s.
Update your security info. Go to “Security” > “Security info.” Remove any phone numbers, email addresses, or app passwords you do not recognize. Add your current phone number and a secondary email address that you control.
Enable two-step verification (2FA). Under “Security” > “Password security,” turn on two-step verification. This requires a code from your phone or authenticator app every time you sign in. This is the single most effective step to prevent future hacks.
Check for forwarding rules and email filters. Attackers often set up inbox rules to hide their activity. Go to your Outlook.com mailbox, click the gear icon, then “View all Outlook settings” > “Mail” > “Rules.” Delete any rule you did not create, especially ones that forward emails to an unknown address or move them to the Deleted Items folder.
Review your recovery codes. Go to “Security” > “Password security” and generate a new set of recovery codes. Store them in a safe place (like a password manager or a printed paper). These are one-time codes that work even if you lose your phone.
Check your other Microsoft services. Review your OneDrive for any suspicious files, check your Xbox profile, and look at your Microsoft Store purchase history for unauthorized charges. If you find any, report them to Microsoft support.

Common Mistakes

Reusing the old password. Even a slightly modified version of the compromised password is dangerous. Use a completely new one.
Ignoring the recovery form. Many people give up if they do not have access to their recovery email. The form is designed for exactly this situation; filling it out accurately is your best chance.
Not signing out of all sessions. Changing your password does not automatically log out every device. You must explicitly use the “Sign me out everywhere” option.
Forgetting about app passwords. If you had app passwords set up for Outlook or other apps, they still work even after a password change. Delete all existing app passwords and create new ones if needed.
Clicking links in the recovery email too late. The link in the recovery email expires after 30 days. If you miss this window, you have to start the whole process again.

Tips

Use a password manager. Generate and store a unique, complex password for your Microsoft account (and every other account). This way you never have to remember it, and you will not be tempted to reuse it.
Set up the Microsoft Authenticator app. This app provides push notifications for sign-in approvals, which is more secure than SMS codes. It also works offline.
Regularly review your sign-in activity. Make it a habit to check the “Sign-in activity” page once a month. Look for anything unusual, even if it is just a login from a new device you own.
Keep your recovery info current. If you change your phone number or email address, update it in your security info immediately. An outdated recovery method is almost as bad as having none.
Do not share your password or codes. Microsoft will never ask you for your password or a verification code over the phone, email, or chat. Any request like that is a scam.

Troubleshooting

The recovery form is rejected. If Microsoft cannot verify your identity, you will get a rejection email. Wait 30 days and try again, providing more accurate details. Double-check the subject lines of emails you listed and the names of contacts. Often, people misremember the exact sender names.
You do not receive the security code. Check your spam or junk folder. If you are using a phone, make sure it has signal. If you have not received it after 10 minutes, click “Resend code.” If it still fails, try the recovery form route.
The attacker changed your recovery email. This is why the recovery form exists. It does not rely on your current recovery info; it asks for historical data that only you would know. Fill it out with as much old information as you can.
You are locked out of your computer too. If your Windows login is tied to your Microsoft account, you may be blocked from your PC. You can use the “I forgot my PIN” link on the login screen, which will guide you through a verification process. If that fails, you may need to use the “Reset this PC” option, which will remove the account lock but may delete some files.
You see suspicious activity after securing the account. If you still see strange logins after changing your password and signing out everywhere, your device may be infected with malware. Run a full antivirus scan with Windows Defender or a reputable third-party tool. Also, check for browser extensions you did not install.

Frequently Asked Questions

How long does Microsoft take to review the recovery form?

It usually takes up to 24 hours, but it can take up to 30 days in complex cases. You will receive an email with the result.

Can I get my account back if I don’t remember any passwords?

Yes, but it is harder. The recovery form asks for other proof of ownership, like email subject lines and contact names. The more details you provide, the better your chances.

What if the hacker changed my primary email address?

The recovery form still works. You will need to provide the original email address and answer the security questions based on your account history. Microsoft can revert the email change if you prove ownership.

Will I lose my emails and files?

No. Securing your account does not delete your data. However, if the attacker deleted emails or files, they may be recoverable from the “Deleted Items” or “Recycle Bin” in Outlook and OneDrive, but only for a limited time.

Is two-step verification really necessary?

Yes. It is the most effective way to stop unauthorized access. Even if someone steals your password, they cannot get in without the second verification code from your phone.

What should I do if I see unauthorized purchases on my account?

Immediately change your password and sign out everywhere. Then, contact Microsoft billing support directly through the official support page to dispute the charges. Do not reply to any emails about the purchases, as they may be phishing.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →