Outlook account hacked: attacker added their email as recovery contact, can't remove it

Question

Outlook account hacked: attacker added their email as recovery contact, can't remove it

Moatasim Yousaf 0

My Outlook account was hacked. The attacker added their own email address as the security/recovery email, so password reset codes go to them and I can't sign in or remove it. What happened: - I lost access to my Outlook account on 31st.
The recovery email on the account is now [moderator's note: PII removed], which I don't own. - The password reset sends the verification code to that address instead of mine.
What I've tried: - Microsoft account recovery form (account.live.com/acsr) And reset my password. What I need: - A way to get the unauthorized recovery email removed and regain access to the account. - Advice on what else to do to secure the account and any linked services. Thank you.

0 comments

2 answers

Your answer

Answer 1

Hi Moatasim Yousaf,

I understand how concerning this situation must be, especially when the verification code is being sent to an address that you do not recognize.

The AI response has already covered the main recovery steps. One important point to clarify is that the unauthorized recovery address cannot simply be removed upon request. Microsoft must first verify account ownership, and support agents cannot bypass this security process, manually change the account information, or send a password-reset link.

Since you have already submitted the recovery form, please try Microsoft’s Sign-in Helper, which may provide the appropriate self-service recovery option or direct you to further assistance. If you are still unable to regain access, you can also contact Microsoft Support and follow any instructions provided for a hacked Microsoft account.

If the security-information change is still pending and the “Let us know” option appears, select it to report that you did not authorize the change.

Please note that this is a public user-to-user support forum. Community members and moderators cannot access your account, review your recovery request, remove the attacker’s recovery address, or check the progress of a support case.

For your protection, please do not share the complete recovery email address, verification codes, previous passwords, support reference numbers, payment details, or other proof of ownership in this public thread. Such information should only be submitted through Microsoft’s official recovery or support channels.

I hope Microsoft Support can help you complete the ownership-verification process and regain control of the account soon. Thank you so much for your understanding.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

If sign-in displays “Your security info change is still pending” or “You can’t access this site right now,” select “let us know” on that page to report that you did not authorize the replacement security email. ^1^

If a security-info change is pending

Open the Microsoft account Security page: https://account.live.com/proofs/Manage
Sign in as far as the process permits.
On Your security info change is still pending, select let us know near the bottom.
Follow the unauthorized-change prompts.

Do not select cancel this request: that option is intended for someone who initiated the change and still has access to the previous verification methods.

When all security information is replaced, Microsoft places the account in a restricted state for 30 days. Microsoft cannot expedite that period. If two-factor verification was already enabled, access during the pending period is more restricted. ^1^

If there is no pending-change page

Since the account recovery form and password reset have already been attempted, use Microsoft’s hacked-account sign-in helper instead. Enter the affected Outlook address; the tool provides the available self-service path or may offer contact with an agent. ^2^

If the helper cannot restore access:

Open Contact Microsoft Support from the support article.
Enter hacked Microsoft account and select Get Help.
Select Contact Support if offered.
If sign-in is required, use a different working personal Microsoft account.
Choose Other Products and Manage account security, then request chat or the available support option.

Support can guide the recovery process, but agents cannot send password-reset links or directly access and change account details, including removing the attacker’s recovery address. ^3^

Immediately after regaining access

Perform these actions from a trusted device:

Scan the device first
- Open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.
- Because the password was already reset before this scan, change it again afterward to a new, unique password. Microsoft recommends scanning before changing a compromised account’s password. ^2^
Replace the unauthorized verification method
- Open Advanced security options.
- First select Add a new way to sign in or verify and add an email, mobile number, Authenticator, or another method you control.
- Expand the attacker’s verification email, select Remove, then confirm.
- Do not remove every verification method simultaneously; removing all security information triggers the 30-day restricted state. ^4^
Review account activity
- Open the Microsoft account Recent activity page.
- Expand entries from the last 30 days.
- For unauthorized entries under Unusual activity, select This wasn’t me. For suspicious entries under Recent activity, select Secure your account.
- Review changes such as aliases added, alternate email added, two-step verification changes, application permissions, and successful sign-ins. ^5^
Check Outlook persistence settings
- Inspect connected accounts, forwarding, and automatic replies and remove anything you did not configure. These settings can remain altered after unauthorized mailbox access. ^2^
Secure linked services
- Change any other account that reused the old password.
- Start with the recovery email account, banking/payment services, shopping accounts, social networks, Xbox, OneDrive, and services where Outlook receives password-reset messages.
- Review Microsoft subscriptions and payment activity for unauthorized changes.
- Enable Microsoft Authenticator or another strong verification method and keep more than one recovery method current. ^3^

Do not publish the attacker’s full address, your account details, recovery codes, purchase records, or other ownership evidence in a public Q&A thread; provide sensitive details only through Microsoft’s official recovery or support interface.

References