Account phone number changed

Do not post the screenshot or full phone number publicly; secure the device first, then review the account activity, change the password, and remove the unfamiliar security method.

If this is a personal Microsoft account

1. Scan the device before changing the password
   • Open Windows Security → Virus & threat protection → Scan options → Full scan → Scan now.
   • Microsoft recommends completing a full malware scan before changing a compromised account’s password.^1^
2. Review recent account activity
   • Open the Microsoft account Security basics page.
   • Select Review activity.
   • Expand unfamiliar entries. Select This wasn’t me for entries in Unusual activity, or Secure your account for unauthorized entries under recent activity.^2^
   • Review the device, browser, application, location, and time—not only the location.
3. Change the password
   • Return to Security basics → Change password.
   • Use a new, unique password that is not used for email, banking, social media, or any other account.
   • If that old password was reused elsewhere, change it on those services too.
4. Correct the phone number/security information
   • Go to Security basics → Update information or Advanced security options.
   • Add and verify a phone number or email address you control first.
   • Expand the unfamiliar phone-number entry and select Remove, then confirm. Microsoft specifically recommends adding replacement information before removing the old method.^3^
   • Review Microsoft Authenticator and all other verification methods. Remove anything you did not configure, then add Authenticator again if necessary.
5. Check account settings
   • For Outlook.com, inspect connected accounts, forwarding, and automatic replies for changes you did not make.^1^

If a security-information change is pending

If the page says “Your security info change is still pending” and you did not initiate it:

1. Sign in to the Microsoft account Security page.
2. In the pending-change window, select let us know near the bottom.
3. Follow the prompts to report the unauthorized change.^4^

Removing all security information can place the account into a restricted state for 30 days. Do not remove every method simultaneously if you can safely add and verify your own method first.

If you cannot sign in

Use Microsoft’s compromised-account sign-in helper. It asks for the account email address or phone number and provides the applicable recovery or support route.^1^

Support agents cannot manually change account details or send password-reset links; account ownership must be established through the recovery process.^5^

If this is a work or school account

Contact the organization’s IT help desk or Microsoft 365 administrator immediately. The administrator should reset the affected authentication methods and require MFA re-registration. You can review your own activity through My Account → Recent Activity; if an unfamiliar successful sign-in appears, change the password and update Security info.^6^

Handle the dark-web alert separately

A Microsoft Defender dark-web alert means monitored information appeared in breach data; it does not by itself establish that someone accessed this Microsoft account. Open Microsoft Defender → Alerts & History → the breach alert and review exactly which information was exposed and the recommended checklist.^7^

If the displayed phone number is not yours, use More actions → I don’t recognize this info. If it was previously yours but is obsolete, use This info is outdated. If financial or government identity information was exposed, follow the alert’s specific protective actions and contact the relevant bank or issuing authority.

References

1. How to recover a hacked or compromised Microsoft account | Microsoft Support
2. What happens if there's an unusual sign-in to your account | Microsoft Support
3. Removing a sign-in verification method | Microsoft Support
4. What does “Security info change is still pending” mean? | Microsoft Support
5. How to help keep your Microsoft account secure | Microsoft Support
6. View your work or school account sign-in activity from My Sign-ins | Microsoft Support
7. Dark web monitoring in Microsoft Defender FAQ | Microsoft Support