Account got hijacked, email changed, security information removed. Cannot get access back.

Hi d_chipp

Greetings!

Thank you for posting in Microsoft Community



I do understand the urgency of you wanting to find other ways for this issue of yours in regards with Your Account. We are very glad to help you out to find some of the best possible options and troubleshooting's that we can provide for you.

We just want to set your proper expectations that in the Microsoft Community we have only limited tools to provide this issue that you are experiencing in relation to your code that is not valid. It's best to discuss this matter on our Microsoft Live Support Team to further investigate your concern, as well as about the efficient procedure that may need to be done. It's best to work with them as they have the tools they need to investigate and isolate the problem and provide a timely resolution with their concern.

Here is the link to reach out to Microsoft Support : Contact Us | Microsoft Support

To connect to our account and billing department, follow the following:

1. Search for Billing
   
2. At the Bottom, click Contact Support
   
3. From the menu, select Microsoft 365 and Office - Billing and Payment Updates
   
4. Click Confirm
   
5. Then click Chat with a support agent in your web browser
   

Note:

1. Please sign in to your Microsoft Account so that you can schedule your call later in the day or chat immediately with an available Office Support Representative.
   
2. Our Phone Team business hours (All U.S Pacific Time) Monday to Friday: 06:00-22:00 and Saturday to Sunday: 07:00-18:00, while chat team is available 24:7.
   

Thank you for reaching out and sharing your issue. I hope all of this information's are helpful. We look forward on your response.



Regards,



Microsoft Community Moderator

I'm not sure either, we could only speculate - the account was hijacked some time ago (perhaps somewhen in the last year), the original email removed, different one added and password changed - the usual when account is hijacked (most likely due to having Minecraft premium - not any pirated launcher). Right now I cannot access what I paid for and I miss the money spent.

Scenario 1) CookedDanny has one email address on file. The one he logs in with. One day, a ne'er-do-well compromises his email, discovers he has an Xbox account attached to it, and performs a password reset to gain access to his Xbox account and take
it over. Without any other security information on file, CookedDanny is not notified of the changes, and the stranger takes the account for a joyride, leaving quite a mess to be cleaned up later.

-

Scenario 2) CookedDanny has his email address on file, and an additional email as a security proof. One day, a ne'er-do-well compromises his email, discovers he has an Xbox account attached to it, and performs a password reset to gain access to his Xbox
account and try to take it over. However, when the perpetrator tries to remove the security email, the system tells him that this change will take 30 days, and sends a notification email to the security proof. CookedDanny is notified by this second email
of the attempt to change. Alerted to the unauthorized access, he secures his primary email with a new password, resets his Xbox password, cancels the request for information change, and neutralizes the stranger's attempts at gaining access to his account.

-

Scenario 3) CookedDanny has his email address on file, and an additional email as a security proof. One day, a ne'er-do-well compromises the secondary security email. This email is not used as a login for the Xbox account, and does not do anything for
the stranger who might have had the inclination to try to hijack an Xbox account.

-

Additional security proofs = increased security.

Additional security proofs =/= additional paths to account compromise.

The likelihood of someone compromising both your Microsoft Account credentials AND your security proof email credentials is extraordinarily slim. For more information about Microsoft Account security proofs, here's a link.

http://support.xbox.com/en-US/billing-and-subscriptions/account-security/security-proofs-overview

I'm afraid not. When an account is hacked, there is a 30 day period for you to recover access. However, if the email address and other security information is changed, account recovery cannot be completed. Please reach back if you have further questions.

Thanks,
Kyle

I have had my Xbox account setup with my work email and phone number ever since i have had an Xbox. I have recently changed jobs so updated my phone number and email address which is linked to my account to my new email and phone number.

[...]due to critical safety information being changed on my account (me updating my email and phone number) and i needed to wait 30 days until my new email and phone number would be accepted. Only then would i be able to log into my account.

Has anyone else had this?

[...]

I'm locked out of my account. Turns out Microsoft does that for you anyway. Should of just left it alone.

This only happens, if you didn't have security info on your account (i.e. a phone number or secondary email), or don't have access to the existing security info to confirm ownership or the change of security info.

If Microsoft were able to send you the verification code for the change to a working email or phone number that was present on the account before you changed emails and phone numbers, then the change would have been done immediately after you could confirm
the code.

For security reasons, if *all* your security proofs are changed, and the old ones aren't confirmed, Microsoft will stall this change for 30 days. Just imagine the following scenario: A hacker got access to your Microsoft Account, but does not have access
to your phone or secondary email. They add their own phone and email, to be able to recover your account eventually.

You will get a message to your email informing you of the change. Unless you confirm that change, the hacker is still unable to use his own security information to completely take over your account.

Since you might be on vacation or other reasons prevent you from immediately reacting on that change, the 30 day waiting period is there to hinder account hijacking. So you'll get a full month of time to act against a hacker taking over your account.

Since this is all automatic, the only way the computer system can differentiate you from a hacker is by confirming your old security info. Also, in the past the support agents were (ab-)used by account hijackers that wanted to speed up the take over, so
the support can't help you speeding up the change, otherwise they might also be helping a hacker to hijack your account.

So for future changes: Make sure that you still have access to your "old" security information,
before you add new security info. That way your changes will be immediate.

Additionally, I'd recommend you enable Two Step Verification and set up the free Authenticator App on your smartphone.

That way you have a third way to authenticate yourself to the service and make security changes on your account more immediate.

You can set up and change the Two Step Verification setting at
https://account.live.com/Proofs/Manage