How to Recover a Hacked Microsoft 365 Account with Changed Recovery Details
Question details
The user needs to regain access to a compromised Microsoft 365 account where the hacker has changed both the password and recovery details, locking them out of important OneDrive files.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- The user's account was hacked, and standard automated recovery attempts are failing because the recovery email and phone number were altered by the attacker.
- Observed behavior
- The account is completely inaccessible, repeated recovery attempts fail, and access to all associated OneDrive files and Office services is lost.
Gather any evidence of account ownership, such as previous passwords, billing statements, or the account creation date, and ensure you are using a secure, virus-free device before starting the recovery process.
Contact Microsoft Support Directly
Since automated methods fail when recovery details are changed, contacting a live support agent is the most effective path to regain access to your account.
When a hacker changes your recovery email or phone number, the standard Microsoft Account Recovery Form may automatically reject your requests. In these severe compromise scenarios, you must bypass the automated system and speak directly with a Microsoft support representative to verify your identity.
Go to the official Microsoft Support contact page (support.microsoft.com/contactus) on a secure browser.
Type 'Hacked account' or 'Compromised account' in the search bar and press Enter to pull up the relevant help topics.
Select the 'Get Help' button, scroll to the bottom of the page, and click the option to 'Contact Support'.
Select 'Microsoft 365' as your product and choose to chat with a support agent. Provide them with your proof of ownership so they can manually escalate your account recovery.
Contact Your Organization's IT Administrator
If your compromised account is provided by a school or employer, the IT administrator has the power to reset passwords and restore access immediately.
Need to Work While Locked Out? Try WPS Office
Waiting for support to recover a hacked Microsoft 365 account can take days. If you need to create, edit, or view documents right now, WPS Office is a powerful, lightweight alternative. It offers a familiar interface and allows you to continue working locally without an expensive subscription or a complex cloud account setup.
- 1. Download the Installer: Visit the official WPS Office website and download the free installation package for your operating system.
- 2. Install the Software: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
- 3. Open Your Files: Launch WPS Office and open any locally saved Word, Excel, or PowerPoint files to continue your work immediately.
Frequently Asked Questions
Can I recover my Microsoft account if I don't have access to the recovery email or phone number?
Yes, but you must use the Microsoft Account Recovery Form. Since the hacker changed your details, the automated form might fail. In this case, contacting Microsoft Support directly with extensive proof of ownership is necessary.
How long does it take for Microsoft to investigate a hacked account?
Investigations can take anywhere from 24 hours to several days depending on the complexity of the case, the backlog of support tickets, and the amount of proof provided by the original owner.
Will I get my OneDrive files back after recovering the account?
In most cases, yes. Once you regain access, your OneDrive files will still be there unless the hacker manually deleted them. If they were deleted, you might still be able to restore them from the OneDrive recycle bin within 30 days.
