Your Microsoft account is the key to Outlook.com and Hotmail email, OneDrive files, Xbox, Skype and often your Windows PC. When it is hacked, the attacker can read your inbox, reset passwords on other sites that send codes to that email, and quietly set up rules that forward your messages to them. This guide covers the official Microsoft recovery path in 2026, what to do if the hacker changed your security info, and how to clean up the hidden changes attackers leave behind.
Signs Your Outlook or Microsoft Account Was Hacked
- Your password stopped working or you are asked to verify your identity unexpectedly.
- Contacts received emails from you that you never sent.
- Messages are missing, marked as read, or end up in folders you did not create.
- Microsoft emailed you about a security info change or an unusual sign-in.
- Unknown purchases on Xbox, the Microsoft Store or your subscription.
Step 1: Reset Your Password
Go to account.live.com/password/reset, enter your email, phone number or Skype name, and choose where Microsoft should send a security code. If any listed recovery email or phone is still yours, enter the code and set a new password that you have never used before. Then go straight to the clean-up steps below, because a reset alone does not remove rules or apps the attacker added.
Step 2: Use the Microsoft Account Recovery Form
If none of the recovery options are yours anymore, choose the option saying you do not have any of them, and you will be routed to the account recovery form at account.live.com/acsr. This form is reviewed automatically, so the quality of your answers decides the result:
- Fill it in from a device and network you have used with the account before, such as your home computer and Wi-Fi.
- Provide a working contact email that is not the hacked account.
- List every old password you can remember, even partially.
- Give exact email addresses of contacts you wrote to recently and subject lines of recent emails.
- Add details from other Microsoft services: Xbox gamertag, Skype name, products purchased and the payment card used.
If the form is rejected, you can try again with more accurate details. Each new attempt should add information, not repeat the same answers.
Step 3: Handle Changed Security Info
When an attacker replaces your security info, Microsoft may apply a waiting period before the change fully takes effect. If you get an email saying your security info is being replaced and you did not request it, use that message to cancel the change. Always confirm the email really comes from the Microsoft account team, and never sign in from a link in an unexpected message; type account.microsoft.com yourself instead.
Step 4: Clean Up What the Attacker Left Behind
This is the step most people skip, and it is why many Outlook accounts are hacked twice.
- Inbox rules and forwarding: in Outlook.com settings, open the Mail section and review Rules and Forwarding. Delete any rule you did not create, especially ones that forward, delete or move messages.
- Sign-in activity: review recent activity at account.microsoft.com under Security, and sign out of all other sessions.
- Security info: remove unknown phone numbers, emails and authenticator apps.
- Apps with access: review apps and services connected to your account and remove anything unfamiliar.
- Payments: check Microsoft Store and Xbox order history and dispute charges you did not make.
- Two-step verification and passkeys: turn on two-step verification with the Microsoft Authenticator app, or add a passkey, so a stolen password alone can no longer get in.
Work or School Accounts Are Different
If the hacked account ends in your company or school domain and is managed through Microsoft 365, the consumer recovery form will not help. Contact your organization’s IT administrator, who can reset the password, revoke sessions and check for mailbox rules on the server.
How Long Does Microsoft Account Recovery Take?
| Situation | Typical timeline |
|---|---|
| Password reset with recovery email or phone | Minutes |
| Recovery form with strong answers | Often within 24 hours |
| Recovery form with weak answers | Several attempts over days |
| Security info replaced by the attacker | Depends on Microsoft’s waiting period |
When Standard Recovery Fails
Repeated form rejections usually mean Microsoft does not have enough matching signals. A structured approach helps: reconstructing old passwords, gathering purchase records, identifying recent contacts and subjects precisely, and submitting from the right device and location at the right pace.
How AccRevert Helps
AccRevert organizes that evidence and walks you through each submission on the platform’s own forms. We never ask for your password or security codes; you stay in control of every login. You start with a flat $299 case-preparation fee. The success fee is $599 for personal accounts, $999 for business accounts and $1,199 for Business Manager and ad accounts, and it is due only if access is restored. See our recovery services for how a case runs.
Frequently Asked Questions
Can I recover my Outlook account without my phone number?
Yes. During the password reset, choose the option saying you no longer have the listed methods, then complete the account recovery form with as much accurate detail as you can, from a device you have used before.
How many times can I submit the Microsoft recovery form?
You can submit it again if it fails, but each new attempt should add new or more precise information. Repeating the same answers rarely changes the result.
Why does the hacker still get my emails after I changed my password?
Most likely a forwarding address or inbox rule is still active. Check the Rules and Forwarding settings in Outlook.com and delete anything you did not create.
Will recovering my Microsoft account also recover my Xbox and OneDrive?
Yes. Xbox, OneDrive, Skype and Microsoft 365 subscriptions are tied to the same Microsoft account, so recovering it restores access to all of them.
Does Microsoft have a phone number for hacked accounts?
Microsoft account recovery is handled online through the reset and recovery forms. Be careful with search results that list Microsoft support phone numbers; tech-support scams commonly impersonate Microsoft.
Final Checklist
- Reset the password if a recovery option is still yours.
- Otherwise complete the recovery form from a familiar device and network.
- Delete unknown inbox rules, forwarding addresses and connected apps.
- Sign out of all sessions and remove unknown security info.
- Turn on two-step verification or add a passkey.
Recovery form rejected again? Open your recovery case with AccRevert: a flat $299 fee starts the work, and the success fee applies only if access is restored.
Related Articles
Stop guessing and document the case properly.
Our team can review the account history, available ownership evidence and the recovery steps already attempted.
X (Twitter) Account Suspended? How to Appeal and What to Expect
Telegram Account Banned or Frozen? How to Appeal and Get Back In
