Account got hijacked, email changed, security information removed. Cannot get access back.

Scenario 1) CookedDanny has one email address on file. The one he logs in with. One day, a ne'er-do-well compromises his email, discovers he has an Xbox account attached to it, and performs a password reset to gain access to his Xbox account and take
it over. Without any other security information on file, CookedDanny is not notified of the changes, and the stranger takes the account for a joyride, leaving quite a mess to be cleaned up later.

-

Scenario 2) CookedDanny has his email address on file, and an additional email as a security proof. One day, a ne'er-do-well compromises his email, discovers he has an Xbox account attached to it, and performs a password reset to gain access to his Xbox
account and try to take it over. However, when the perpetrator tries to remove the security email, the system tells him that this change will take 30 days, and sends a notification email to the security proof. CookedDanny is notified by this second email
of the attempt to change. Alerted to the unauthorized access, he secures his primary email with a new password, resets his Xbox password, cancels the request for information change, and neutralizes the stranger's attempts at gaining access to his account.

-

Scenario 3) CookedDanny has his email address on file, and an additional email as a security proof. One day, a ne'er-do-well compromises the secondary security email. This email is not used as a login for the Xbox account, and does not do anything for
the stranger who might have had the inclination to try to hijack an Xbox account.

-

Additional security proofs = increased security.

Additional security proofs =/= additional paths to account compromise.

The likelihood of someone compromising both your Microsoft Account credentials AND your security proof email credentials is extraordinarily slim. For more information about Microsoft Account security proofs, here's a link.

http://support.xbox.com/en-US/billing-and-subscriptions/account-security/security-proofs-overview

I have had my Xbox account setup with my work email and phone number ever since i have had an Xbox. I have recently changed jobs so updated my phone number and email address which is linked to my account to my new email and phone number.

[...]due to critical safety information being changed on my account (me updating my email and phone number) and i needed to wait 30 days until my new email and phone number would be accepted. Only then would i be able to log into my account.

Has anyone else had this?

[...]

I'm locked out of my account. Turns out Microsoft does that for you anyway. Should of just left it alone.

This only happens, if you didn't have security info on your account (i.e. a phone number or secondary email), or don't have access to the existing security info to confirm ownership or the change of security info.

If Microsoft were able to send you the verification code for the change to a working email or phone number that was present on the account before you changed emails and phone numbers, then the change would have been done immediately after you could confirm
the code.

For security reasons, if *all* your security proofs are changed, and the old ones aren't confirmed, Microsoft will stall this change for 30 days. Just imagine the following scenario: A hacker got access to your Microsoft Account, but does not have access
to your phone or secondary email. They add their own phone and email, to be able to recover your account eventually.

You will get a message to your email informing you of the change. Unless you confirm that change, the hacker is still unable to use his own security information to completely take over your account.

Since you might be on vacation or other reasons prevent you from immediately reacting on that change, the 30 day waiting period is there to hinder account hijacking. So you'll get a full month of time to act against a hacker taking over your account.

Since this is all automatic, the only way the computer system can differentiate you from a hacker is by confirming your old security info. Also, in the past the support agents were (ab-)used by account hijackers that wanted to speed up the take over, so
the support can't help you speeding up the change, otherwise they might also be helping a hacker to hijack your account.

So for future changes: Make sure that you still have access to your "old" security information,
before you add new security info. That way your changes will be immediate.

Additionally, I'd recommend you enable Two Step Verification and set up the free Authenticator App on your smartphone.

That way you have a third way to authenticate yourself to the service and make security changes on your account more immediate.

You can set up and change the Two Step Verification setting at
https://account.live.com/Proofs/Manage

Hello!

The message you are seeing is normal since you no longer had access to any of the security information on your account. This security measure prevents others from taking over your account by changing the security information. The wait time is indeed 30
days, and your new security information will automatically apply to your account at that time. You'll receive an email when the change is complete.

If you do have access to the prior security info, you can cancel the change and that will allow you access to your account again. Otherwise, you will need to wait the full 30 days as that cannot be overridden by anyone.

For more information, please see:
www.xbox.com/.../Account-Security

Are you still able to sign in on your account security page at
https://account.live.com/Proofs/Manage? If not, follow the instructions for a compromised account here: https://support.xbox.com/my-account/security/compromised-account-solution

If you were able to get to the Proofs Managing page, you can remove the alternative address. Then change your password to something very secure. I recommend thinking of a sentence you can easily remember. Like for example "This sentence is my password. I
can remember it well!" Then take the first letter of each word and the punctuation and you get "Tsimp.Icriw!" which would be a complex password that you can still easily remember.

Then, after changing your password, scroll down on the page and enable Two Step Verification and set up the free Authenticator App on your phone.

After you've done that, add your own phone number and alternative email addresses at the top, so you can recover your account with that information.

And remember to keep that information up to date, BEFORE you change phone numbers or emails! You will have to confirm a code that is being sent to the email or phone number. If you change that security information without access to your email or phone number
there, changing the security info takes 30 days, to prevent account hijacking.

The problem was that you did not have access to the security proof that was on the account when you originally started this process.

All you had access to was the email and password.

Therefore Microsoft to make sure people are not just getting peoples emails and passwords for their accounts and going in and changing information on the accounts and stealing the accounts they require a verification of ownership by sending out a code to
the security proof on the account.

They do realize that some people no longer have access to the security proof on the accounts so that is why they do put this 30 day hold on accounts if you can remember the email and password for the account.

The ONLY way to get past this 30 day hold would be to gain access back to the previous security proof that was on the account.

If you gain access back to the security proof on the account and try and do something it will give you the choice to cancel the proof change and send a code to one of the old security proofs.

Otherwise you will need to wait the 30 days.