Account recovery alternatives

you should always update account phone numbers as soon as you know they are to be changed, also setup alternative recovery email addresses and make a note of the account recovery code. support are not able to assist due to 2fa as they cannot access that.

When you started the investigation they asked you for an alternate email, That's the one that will be getting the account recovery email along with codes for points if need be.

You can try the recovery form. But don't use the current email address (because probably you're going to "recover" the recently created Microsoft account)

On the recovery form, try alternative emails if you added one to the account
If not, try instead using a phone number previously added as well

FYI - when they invalidate your billing, you are NOT locked out of your account. You can simply go in and re-validate the billing or provide an alternative billing method. This does NOT stop someone who has access to your account (perhaps loaded on their
console) from doing just that.

And don't just change passwords, change everything. You have had your ID stolen. Create a new WLID. Move your Gamertag there. Don't use secret passphrases or 'alternative e-mail' for recovery. Use Trusted PC or SMS. Check your WLID's alternative e-mail
address (for recovery purposes) -- it's common for the FIFA hack for the attacker to add an account there. REMOVE IT.

@Miss Portia - I got a phone call from someone who needed an alternate email for me. We talked about the process of account recovery, and this is what he told me.