Password & Account Recovery

How to Recover a Hacked Microsoft Account After Email and Password Changes

Kushani Nimanthika Oct 21, 2026 868 views

Question details

The user needs to recover a compromised Microsoft account where the attacker has altered the login email address, password, and original security proofs.

How to Recover a Hacked Microsoft Account After Email and Password Changes

Product: Microsoft Account
Device & OS: not provided
Scenario: Attempting to regain access to a personal Microsoft account after a malicious takeover.
Observed behavior: The original owner is completely locked out of the account because the login credentials and recovery methods have been entirely replaced by an unauthorized party.

Before you start

Gather any details related to your original account, such as previous passwords, previously linked phone numbers, Skype contacts, or recent Xbox/Microsoft billing statements, as you will need these to prove your identity.

Solution 1Recommended

Dispute the Unauthorized Security Information Change

Use this method immediately if you receive a notification that your security information is being updated, to lock down the account and prevent the attacker from taking full control.

When an attacker attempts to change all security proofs on a Microsoft account, Microsoft initiates a 30-day waiting period. During this time, the true owner can cancel the request if they still have access to the original email or if the session is still partially active.

Navigate to the Security Proofs Page

Open a web browser and go directly to the Microsoft account security management page at https://account.live.com/proofs/Manage.

Indicate an Unauthorized Change

On the security-information-change alert screen, look for a prompt stating that your security info is being replaced. Click the link that says 'I didn't make this change' or 'Cancel this request'.

Verify Your Identity

Follow the on-screen prompts to verify your identity using any original recovery methods that might still be partially recognized.

Wait for the Restricted State

Once flagged, Microsoft will place the account in a 30-day restricted state. This pauses the attacker's ability to finalize the security changes while the dispute is investigated.

Dispute the Unauthorized Security Information Change

About the 30-day restriction: The 30-day restricted state is a security measure to protect the rightful owner. During this period, sensitive account settings cannot be altered.

Solution 2

Contact Microsoft Live Support Directly

Use this method if the attacker has already finalized the email and password changes and the automated recovery forms are no longer accepting your original details.

Free Microsoft Office alternative

Use WPS Office While Recovering Your Microsoft Account

Locked out of Microsoft 365 due to a compromised account? WPS Office is a completely free, lightweight alternative that lets you view, edit, and create documents locally without requiring a Microsoft account. It features high compatibility with all Microsoft Office formats and provides a familiar user interface to keep your work uninterrupted while you resolve your account issues.

1. Download the Free Software: Visit the official WPS website and download the installation package for Windows, Mac, or Linux.
2. Install WPS Office: Run the installer and follow the quick setup wizard to install the suite on your device.
3. Open Your Office Files: Double-click your existing .docx, .xlsx, or .pptx files to instantly open and edit them in WPS Office.

No Microsoft account or internet connection required to edit documents locallyFully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Familiar user interface with zero learning curve for Office usersLightweight installation package that doesn't consume excessive system resources

microsoft office alternative - wps office

Frequently Asked Questions

What does the 30-day restricted state mean for my Microsoft account?

It means Microsoft temporarily blocks all sensitive changes, such as modifying security information or linked email addresses, for 30 days. This gives the true owner time to realize the account is compromised and dispute unauthorized changes.

Can I recover my Microsoft account if I don't know the new email address the hacker set?

Yes. You should initiate the recovery process or contact support using your original email address or phone number. Microsoft's support team can trace the account's history and locate it based on your past billing and usage data.

Why is the automated account recovery form instantly rejecting my requests?

If the attacker completely removed your original email address and replaced it with their own, the automated recovery form may no longer recognize your old email as an active account. In this case, you must contact Microsoft Support directly through live chat.

Login & Account Issues