Independent guide - not affiliated with or endorsed by Microsoft. We never ask for your password, codes or account details. For official help use Microsoft's account recovery form or support.microsoft.com.
How to Recover a Hacked Microsoft Account
Published October 16, 2026. Updated October 16, 2026.
If your Microsoft account has been hacked - you cannot sign in, your password no longer works, or you are getting alerts about activity you did not do - the order of your steps matters. Scanning your device before you reset anything, and undoing the changes an attacker made after you get back in, are the parts people most often miss. This independent guide follows Microsoft's official recovery process and links to its support pages throughout. We never ask for your password, codes or account details.
Signs your account was taken over
Common indicators include being unable to sign in with a password you know is correct, sent items or contacts you do not recognise, missing emails, security-info changes you did not make, and alerts from account-security-noreply@accountprotection.microsoft.com about new sign-ins. If you can still sign in, check the Recent activity page at account.microsoft.com/security and mark anything unfamiliar as "This wasn't me".
Step 1: Scan your device for malware first
Microsoft is explicit that you should "run a full scan on your PC before you change your password", because malware can capture the new password as you type it. Make sure your antivirus app is up to date and run a full scan. If you have no antivirus app, Microsoft points to Microsoft Defender: open Windows Security, choose Virus & threat protection, then Scan options, Full scan, and Scan now. Set the app to update and scan automatically from now on.
Step 2: Change or reset your password
Once the device is clean:
- If you can sign in: change your password straight away and choose a strong one you have never used elsewhere.
- If you cannot sign in: reset the password instead. Start with Microsoft's sign-in helper, which asks for your email or phone number and then offers self-help steps. If the attacker changed your contact details so a reset will not reach you, use the account recovery form to prove ownership. Our page on what to do when the recovery form is not working helps if a first attempt is declined.
Microsoft notes that if two-step verification was on and its details were replaced during recovery, there is a 30-day wait before the change takes effect. That delay is a safeguard against the attacker doing the same thing to you, so plan around it rather than trying to bypass it.
Step 3: Undo the changes an attacker made
Because someone else had access, Microsoft automatically resets some settings, but you should still check the areas attackers typically abuse to keep a foothold:
- Connected accounts - remove any you do not recognise.
- Email forwarding - attackers add a rule that quietly copies your mail to their address; turn it off.
- Automatic replies - check these have not been turned into spam or phishing messages.
Also review your security info (phone numbers, alternate emails and app registrations) and delete anything you did not add. Then look through Recent activity once more to confirm no new unfamiliar sign-ins appear.
Step 4: Lock the account down again
With control restored, make a repeat takeover harder:
- Add at least two current security methods - an up-to-date phone number and a second email you control.
- Turn on two-step verification following our MFA setup guide.
- Generate a new account recovery code and store a printed copy somewhere safe, away from the device you sign in with.
- Sign out everywhere and sign back in on your trusted devices.
If the account is work or school
The steps above are for personal Microsoft accounts such as Outlook.com, Hotmail, Xbox and Skype. A work or school account issued by an organisation is controlled by that organisation's IT administrator, who can reset it and review its security. For those, point your admin to the organisation's reset tools such as aka.ms/sspr and aka.ms/mysecurity.
Avoiding the scams that follow a hack
After a breach, criminals often follow up pretending to be Microsoft support. Microsoft does not send unsolicited messages or make unsolicited calls asking for personal information, its warnings never contain a phone number, and it will never request payment in gift cards or cryptocurrency. If someone offers to "fix" your account by phone, remote session or a link they send, it is a scam. Report it at microsoft.com/reportascam, and see our note on which Windows warnings are genuine.
Frequently asked questions
What should I do first if my Microsoft account is hacked?
Run a full antivirus scan before anything else. Microsoft advises this because malware on your PC can capture a new password the moment you set it. Only after the scan should you change your password.
The hacker changed my email and password. Can I still recover it?
Yes, this is what the recovery process is for. Start with Microsoft's sign-in helper; if you cannot reset the password, use the account recovery form to prove ownership. Microsoft resets some account settings automatically when it confirms someone else had access.
How long does it take to get a hacked account back?
It varies. If you can still receive a security code it can be quick. If you must use the recovery form, Microsoft reviews it and replies by email. When two-step verification details were replaced, Microsoft applies a 30-day waiting period before the change takes effect.
Will Microsoft call me or send a reset link to help?
No. Microsoft states its support agents cannot send password reset links or access or change account details except through the reinstatement form, and its warning messages never include a phone number. Treat any call or message offering this as a scam.
What should I check after I get back in?
Review connected accounts, email forwarding and automatic replies, because attackers often add these to keep reading your mail. Also check recent activity, update your security info and generate a fresh recovery code.