Account had 2FA, was compromised, and now 2FA is stopping me from recovering it

Nedas Bolevicius · Mar 9, 2025

I had my gmail compromised via real-life events. Long story short, a friends computer was compromised, which in turn allowed my gmail to be hacked (frankly, no reasonable malpractice on my end). This gmail account was then used to log into my Microsoft account, which had Authenticator 2FA enabled. They then, again, changed the password without using 2FA, changed the email (username?), and essentially locked me out of my account.

I am (was*, support blocked my account) able to log into my account using GitHub, but I cannot do much more, as all security actions require either a code from 2FA, or email code. However, the 2FA code no longer works.

Account recovery forms simply did not work, tried multiple times. Messaged support, and the response I got was "We cannot do anything because security or something". Take this link, for example, in which the very first bullet point is if you have enabled 2FA, you're sh** out of luck. Not only that, they simply suspended my account and said goodbye. So heck, even I myself no longer have access to my account, even via GitHub. But I still see random codes showing up in my 2FA!

So really, 2FA did nothing to stop the attacker locking up my account, took seconds for them to completely compromise everything, and the only thing 2FA did is keep ME out of recovering my own account? I'm sure you can agree that sounds completely absurd.

What do I do? What even is there to do? The power all lies in Microsoft hands, but it seems like these hands do not wish to stop this very glaring and obvious security flaw. In fact, out of all services that were compromised from my gmail hack (in the double digits), Microsoft was the ONLY company which was not able to recover my account. Even more, most companies didn't even allow the account to be compromised, even having full access to my email (also had 2FA on everything). I see so many accounts being locked up the same way, surely there's something that me and the thousands of other people have missed?

Really, any help would be appreciated. I hope you understand why I'd be angry at this situation that is completely outside my control.

:)

KindGryphon

Thanks all, I've been in contact with support who and in the process of recovering the account. Hopefully they'll be able to get it back.

Paypal password has been changed and credit card stopped.

If you do manage to get it back definitely enable 2FA. Also make sure you use a password that you dont use anywhere else as that is also one of the most common ways accounts can get compromised is using the same password for multiple sites.

I used to be guilty of using the same password everywhere (like a lot of people are) and have had accounts compromised because of it in the past so now i use a different password for everything and have 2FA enabled for every account that offers it (most
do nowadays) and havent ever had an issue like that ever since

KindGryphon

Got an account, I removed the account from the authenticator, I don't have any codes, I have nothing except for an email (I don't know my password). Can I recover the account?

If you didnt save the backup codes that you were given when you first enabled 2fa (which is meant for this exact sort of situation) then the account is unfortunately lost for good.

Georges C.

Hello, first it's a pleasure to be able to help you today.

My name is welcome to the community.

Hello KyLuv, from the reply email you received it looks like your account was hacked and they activated 2FA.

Unfortunately with active 2FA it is not possible to recover your account.

Georges C.

Hello again, when 2FA is not active you can recover your account by filling out the form or contacting support and carrying out a procedure with them, I just find it strange that they do not mention that when 2FA is active it is not possible to recover the account.

jit banerjee

I have implemented the 2FA right now. However, there are customers like me who didn't had 2FA set up but that doesn't really mean that our accounts are not secure. We expect security measures from microsoft when signing in an user who don't have 2FA set up. Anyway how do I get back my money? I don't see a refund option in the purchase list.

Account had 2FA, was compromised, and now 2FA is stopping me from recovering it

Account had 2FA, was compromised, and now 2FA is stopping me from recovering it

Account hacked and stolen

Recover account from 2FA

My account got permanently suspended for no reason

Cannot log into Xbox live because of two factor authentication. I have an old Xbox live account I am trying to sign into, however I cannot. Can I please have help?

Someone Hacked my Microsoft account and sent xbox gift cards. How do I get refunds?

Account had 2FA, was compromised, and now 2FA is stopping me from recovering it

Account had 2FA, was compromised, and now 2FA is stopping me from recovering it - Similar Threads - Account 2FA was

How do i unlock my locked account if i have 2fa enabled. I can provide the codes and...

Can't recover microsoft account password due to 2fa

Microsoft account hacked, email changed, 2FA enabled.

Why do Microsoft let hackers bypass 2fa and take your xbox account

Account Hacked with 2FA support form unhelpful

My Microsoft account is being compromised despite 2FA

Microsoft Account Login Issue – Ongoing "Temporary Problem" with 2FA (or rather 3FA OTP/SMS...

My account got hacked a couple months ago and I have 2fa enabled on that account what do I do

Locked out of account due to 2FA