Hacked Microsoft account
Hacked Microsoft or Outlook account: the procedure, in order.
Microsoft recommends first scanning your device with up-to-date antivirus, then signing in and changing your password — or resetting it if you can no longer sign in. If the reset fails, complete the account recovery form from a device you have used with this account before: Microsoft reviews the answers and responds within 24 hours, with at most two attempts per day. Its support agents cannot send password reset links or change the account for you.
Reviewed on by Danilson Ramos · version 1.0
You can still sign in
- Scan the device firstUp-to-date antivirus, full scan — before typing a new password.
- Change the passwordA new, unique password.
- Open Recent activityFor activity you don’t recognise, choose “This wasn’t me”: Microsoft guides you to change your password and security info. Mobile networks can show a location other than where you were.
- Re-check your settingsMicrosoft resets some settings after someone else had access: check connected accounts, forwarding and automatic replies.
- Check your security infoThe phone and alternate email must be yours.
- Turn on two-step verificationWith an authenticator app rather than text messages where possible.
You can no longer sign in
- Reset the passwordFrom Microsoft’s official sign-in page.
- Otherwise, the recovery formFrom a device you previously used with this account, ideally from a usual location. Give a contact address other than the compromised one.
- Be precise, not hastyMicrosoft answers within 24 hours; at most two attempts per day.
- If money is involved, call your bankBefore anything else.
What not to do
- Don’t type a new password on a possibly infected device.
- Don’t pay anyone to “recover” the account: Microsoft states that even its own agents cannot change an account for you.
- Don’t submit the recovery form again and again: attempts are limited and one precise answer is worth more than several rough ones.
- Never share a verification code.
Warning signs
- Your password no longer works.
- Unknown activity on the Recent activity page (it covers the last 30 days).
- Sent emails you didn’t write.
- An Outlook forward, rule or automatic reply you didn’t create.
- Connected accounts you don’t recognise.
The legitimate options
Microsoft’s official procedure
Change or reset the password, then the recovery form.
The Recent activity page
To spot and report activity that isn’t yours.
The NCSC and the police
Report the incident; file a complaint if money was lost.
When a specialist helps
- The recovery form was refused.
- Two-step verification is on and you have no alternate method left: Microsoft states it cannot help in that case.
- Bank or business accounts depend on this address.
- It is a company Microsoft 365 account: see the dedicated guide.
Cyber Initial Diagnosis
A written plan for your situation
CHF 99
The diagnosis reviews your situation, the answers you can give in the form and what depends on the compromised address, then gives you a written plan. I never fill in the form in your place.
- A review of one main incident or one compromised account, based on the facts and evidence you provide
- The legitimate recovery and access options open to you
- The immediate risks, ranked by urgency
- A written action plan: what to do, in which order, through which official channel
- A clear answer on whether a follow-up intervention is useful and feasible
Limits
- Only Microsoft decides on a recovery; no outcome is guaranteed.
- Bynilson is independent of Microsoft.
- For a business account, the tenant’s administrator decides.
- No recovery or remediation work is included (quoted separately when useful)
- No guaranteed outcome: only the provider (Google, Microsoft…) decides to restore access
- No monitoring and no emergency on-call
- One incident or one account per diagnosis
Frequently asked questions
Can Microsoft support reset my password?
No. Microsoft states its support agents aren’t allowed to send password reset links or to access and change account details.
How many times can I submit the recovery form?
At most two attempts per day, according to Microsoft. Gather precise answers first.
How long until I get an answer?
Microsoft states it reviews the answers and responds within 24 hours.
Recent activity shows a city I’ve never been to: am I hacked?
Not necessarily: Microsoft notes that mobile networks can show other locations. Check the time and the device before concluding.