[GUIDE] How to recover a hacked account with Microsoft support

INTRODUCTION

Someone changed your password and your account details on your Microsoft account? Do you want to get back into your account or get your purchases transferred to a new account?

This guide is designed to help you navigate through Microsoft support to recover a compromised Microsoft account. It will give you steps to follow according to your situation and provide useful knowledge to maximize your chances of getting your case resolved.

In any case, I recommend reading section III which provides general help and information about Microsoft support.

SUMMARY

I - How to recover your account

A - 2FA is disabled

B - 2FA is enabled

C - Your account is registered on an Xbox console

D - Your account alias has been changed

E - You regained access to your account, but it has been locked

II - How to contact Microsoft support

A - Account & billing support

B - Xbox support

C - Microsoft support hierarchy

III - Preparing and handling your case

A - Questions asked to prove your ownership of the account

B - Questions asked to prove the existence of the account

C - Tips & Tricks

D - About the data transfer

IV - SUBJECTIVE PART : Quality of Service

A - About the waiting times

B - About the agents' ability to do their job

C - You can rarely trust the agents

D - Human-handled forms are inconsistent

E - About their automated translation

F - They don't look into details

V - What you can do to secure your account

I - How to recover your account

Sections I.A and I.E assume that your account alias (the email acting as a username to log in) has not been replaced, or you were able to find the full account alias that the hacker promoted. Please read the subsection that best describes your situation.



A - 2FA is disabled

The hacker changed your password and recovery options (email, phone, etc.) but didn't enable 2FA.

Because 2FA is disabled, you are eligible to fill out the ACSR form (also known as the account recovery form). This automated form will allow you to reset your password after passing verification.

You can attempt the form 2 times/day until you succeed. Fill in as much information as you can. Guessing is recommended if you don't know an answer. Microsoft gives general advice on filling out this form on its website :

Anyway, here's what is asked in the form :

1. Account alias, contact email

2. Name, last name, birthdate, country where you created the account, ZIP code

3. Previous passwords used on the account, services used on the account, purchases made with the account

4. IF YOU USED OUTLOOK : email from your contacts, exact subject of emails you recently sent

5. IF YOU USED SKYPE : nickname, email used to register to Skype, 3 contacts nickname (or name/last name), have you ever paid for something on Skype?

If you paid for something on Skype : the amount of your recent order, date of order, 2 phone numbers you recently called using Skype

6. IF YOU OWN AN XBOX : Xbox model, gamertag, console ID

7. IF YOU MADE A PURCHASE WITH YOUR ACCOUNT : name of card holder, 4 last digits of credit card, expiration date

After filling out the form, you will receive an email to your contact address telling you whether you passed the verification.

If you succeed, you'll be provided a link to reset your password. There, you'll be able to get into your account and remove the hacker's changes.

If you keep failing the form, you can try the options provided in the other sections of this guide.

NB : If 2FA has been enabled on your account, you will receive an email telling you that the form won't be handled because of that.

B - 2FA is enabled

Most of the time, the hacker enables 2FA on your account to prevent you from using the ACSR form. In that case, no one will be able to log into the account without access to the account security information (recovery email/phone) including Microsoft!

Now your only option to get your account back is to access the new security information promoted by the hacker, which is almost impossible.

However, you can get your account suspended to prevent it from being sold (and thus giving money to the hacker), and you can get your data transferred to a new Microsoft account. Indeed, Microsoft has a dedicated process for that situation. After following the procedure, your account will be permanently locked, and your data will be transferred to a new Microsoft account that you will create.

As your account is not linked to any console, you'll have to create a ticket with the account & billing service from Microsoft support. Here's how :

1. Contact the account & billing support (see section II.A)

2. The agent gives you a ticket number (ask for it if they didn't do that). Please note/screenshot your ticket number!

3. Explain your problem to the agent, and give them the original alias of the account if it has been changed

4. The agent asks questions to determine that you're the account's legitimate owner (see section III.A)

5. The agent asks you to create a new Microsoft account that will be used to transfer your data

6. You receive an email from the agent meant to update you during the processing of your case

7. Your case is escalated to the top-level support

8. The top-level support examines your account to check if it is compromised

9. The top-level support checks your answers to determine your ownership of the account

10. You receive a response from the top-level support by email.

Please note that whether you are the account owner or not, your account will be permanently locked if the top-level support finds that it has been compromised. It is part of the procedure.

If you manage to get access to the account security information after that, please see section I.E to unlock your account.

If you pass verification from the top-level support, your data should be transferred to your new account.

BEWARE, as explained in section III.D, the data transfer is very UNLIKELY to happen!

C - Your account is registered on an Xbox console

In this situation, the hacker changed your password, replaced all your security information, and enabled 2FA. However, your account was tied to an Xbox console. Then you're in luck because Xbox support can transfer your game data (games owned, high scores, and achievements) to a new account! Here's how :

1. Contact Xbox support (see section II.B)

2. The agent gives you a ticket number (ask for it if they didn't do that). Please note/screenshot your ticket number!

3. Explain your problem to the agent

4. The agent asks questions to determine that you're the account's legitimate owner (see section III.A)

5. The agent asks you to create a new Microsoft account that will be used to transfer your data

6. You receive an email from the agent meant to update you during the processing of your case

7. Your case is escalated to the top-level support

8. The top-level support examines your account to check if it is compromised

9. The top-level support checks your answers to determine your ownership of the account

10. You receive a response from the top-level support by email

Now, just to be clear, this is almost the same process as described in section I.B. It is done with Xbox support because your account is tied to a console, and thanks to that, they can transfer your account’s game database to another account.

Please note that whether you are the account owner or not, your account will be permanently locked if the top-level support finds that it has been compromised. It is part of the procedure.

If you manage to get access to the account security information after that, please see section I.E to unlock your account.

Your data should be transferred to your new account if you can prove your ownership of the account.

If your data has not been transferred, you need to restart the procedure and ask for a new transfer.

D - Your account alias has been changed

Your account alias is the email that you use to log in to your account. It can differ from your recovery email. If it gets changed, attempting to log in with your original alias will display an error saying that your Microsoft account doesn't exist.

Not knowing your account alias prevents you from filling out the ACSR form (section I.A) and prevents you from logging back in even if you have access to your account security information (section I.E).

However, you can still contact support to initiate a transfer procedure (see sections I.B and I.C). Indeed, Microsoft can trace your account using the original alias!

Please note that the sooner you start the procedure, the better the chances are that Microsoft can trace your account.

Now, you may want to find your new account alias to ease the work of Microsoft support. In that case, getting access to your account security information won't help you, since Microsoft will only display your alias in an obfuscated manner when using their integrated tools.

Still, there are other options that you can try to see the uncensored alias of your account :

1. From a Windows device where you’re already signed in, select Start > Settings > Accounts. Under Email & app accounts, you'll see the usernames associated with your device

2. If you own an Xbox console, visit this XBOX support page

3. Open an Office app, like Word or Excel. Select File > Account. Under Product Information, you'll see Belongs to with the associated username

4. Check every site or application that you used to log in with the account (e.g. : Microsoft Store)

E - You regained access to your account, but it has been locked

Alright, you somehow managed to get access to the account security information or to change them back. However, your account has been locked because of the procedures detailed in section I.B and I.C.

You can ask Microsoft support to unlock your account via the reinstatement form.

This form asks for :

- Your full name

- A contact email

- Your account alias

- Your phone number

- A description of your situation

- The product you want to access (Outlook.com/Xbox)

- The exact issue you're encountering ("I am getting an error that my account has been temporarily blocked")

Upon completing the form, you'll receive an automated email with your SIR ticket number (format : SIRXXXXXXXX).

After 24-72 hours, you should receive a reply from the top-level support telling you whether they have unlocked your account.

Please, fill in the description very carefully, as your first attempt will be read attentively by the top-level support and subsequent attempts are very likely to never be read. Instead, the top-level support will probably send back their last response to you.

If the reinstatement form failed, you can explain your situation to the Microsoft privacy team which will transfer your case to the top-level support that will re-examine your case. Here's how :

1. Visit https://www.microsoft.com/en-us/concern/privacy

2. Select I want to make a request about my personal data

3. Select I want to contact the Microsoft privacy team or the Microsoft Data Protection Officer

4. Fill in the form

a. Under product, select Microsoft Account

b. Select your country

c. Carefully explain your situation

d. Provide a contact email address

5. You receive an automated response containing your PRV ticket number (format : PRVXXXXXXX)

6. The Microsoft Privacy Team reach out to you to get more details on your request

7. The Microsoft Privacy Team escalates your request to the top-level support and opens a ticket for you (you receive a SIR ticket)

8. A top-level support agent asks you questions to determine your account ownership (see section III.A)

9. You receive a response from the top-level support telling you whether your account has been unlocked

If you pass the verification, your account should be unlocked. If this is not the case, repeat the procedure until it works (see section IV.D).

II - How to contact Microsoft support

Microsoft support is very large, and each service has its own category. To get the best help from Microsoft support, you need to contact the right department. This section aims to give you the steps to contact each relevant support service.

You need to sign in to reach support. That means you may need to create a new account (which will be used in the procedures detailed in sections I.B and I.C) or use another account to handle your support cases.

A - Account & billing support

This is the right department for account issues when you don't own an Xbox console. To contact them, follow these steps :

1. Visit https://support.microsoft.com/en-us/contactus

2. Select Microsoft 365

3. Select Get Home support

4. Type in something generic in the search bar (e.g. : "Help"). What you type in this step impacts your choices during step 8.

5. Click on Get Help

6. Scroll to the bottom of the page and click on Contact Support

7. Under product, select Microsoft 365 and Office

8. Under category, select Billing and Account Profile questions (always pick an option related to billing)

9. Click on Chat with a support agent in your web browser to be queued for a chat with the next available random agent

Please be sure that you're talking with an "account & billing" representative before continuing your conversation with the agent, as they're in charge of any account-related issues!

B - Xbox support

This is the right department for account issues when you own an Xbox console. To contact them, follow these steps :

1.Visit https://support.xbox.com/en-US/contact-us

2. Under Try our virtual agent click on Ask a question

3. Type "talk with agent"

4. Select Password reset/Recovery

5. Select Call me back and type in your phone number to get a call back from the next available random agent

5bis. Select Chat to be queued for a chat with the next available random agent



C - Microsoft support hierarchy

In our scope (compromised accounts), there are 3 levels of Microsoft support :

- Level 1 support : those are the agents that you can reach when requesting a callback or an online chat session. They have no power over your account and can only view censored information about it if you provide them with a security code (you need to have access to the account's security information). Their main job is to create a case and escalate it to the next level if required.

- Level 2 support : those senior agents review the case to check whether they can forward it to the top-level support or not.

- Level 3 support (top-level support/External Advanced Capability Team) : these agents handle all the SIR tickets and are the ones performing the investigation on your account during the procedures detailed in sections I.B and I.C. They can provide password reset links if 2FA is not enabled on your account. They have powerful tools to investigate your account activity and can determine your ownership of an account. They also have the power to lock/unlock Microsoft accounts. You can never reach them directly; you have to go through a procedure or a form for them to contact you.

Finally, the Microsoft Privacy Team is considered level 2 support. Their job is to handle PRV tickets regarding personal data. They can transfer your request to the top-level support.

III - Preparing and handling your case

This section aims at providing useful information to prepare the answers you'll provide to prove your ownership of the compromised account. It will also contain some advice to help you get to the end of a procedure.

A - Questions asked to prove your ownership of the account

To determine your ownership over your account, the first level of support usually asks for the following information :

1. Your profile information on the account :

- Skype profile name

- Name

- Birthdate

- Country/region

- Region/state

- Postal/ZIP code

2. Contact phone (your number + a preferred callback time [including weekends !])



3. Skype :

- Provide five names that are in your Skype contacts list

- Provide four phone numbers that you have recently called or contacted using Skype

4. Outlook :

- The email addresses of several contacts from the address book (at least three emails)

- Recent subjects of email sent from the account (at least three subjects)

- The names of any email folders created

5. Billing information used for recent purchases or subscriptions :

- Name on credit card on the account

- Last four digits of the card

- Expiry date

6. IP addresses where the account is often used (https://mylocation.org)



7. Account history :

- The date that the account was created

- The date that you last successfully logged in to the account

- The date that you last changed the password

- Alternate email addresses or phone numbers that are associated with the account

- Location where the account was created

8. Your situation :

- Is the primary account user an adult or a child? (Adult/Child)

- Was there a recent password change? (Yes/No)

- Were there security proofs on the account that were not recognized?

- Are there unauthorized charges on the account?

- Amount of unauthorized charges (if any)

- Did you create a new Microsoft account? (Yes/No)

9. Xbox Customers :

- What is your Xbox Gamertag?

- What is your Xbox One device ID or Xbox 360 Console ID

- Have you discarded or sold your console in the past year? (Yes/No)

10. Miscellaneous :

- Has there been regional migration? (Yes/No)

- Has there been a license transfer? (Yes/No)

- Is there a previous SR containing unauthorized access/account takeover, or UA/ATO in the subject line? (Yes/No)

TIP (quoted from an email I received from the top-level support) :

Please use the information that you believe has been associated with the account, even if it may have changed. If the account was hacked and the information has changed, we will still attempt to validate the account based on the information associated before the change.

B - Questions asked to prove the existence of the account

When your account alias has been changed, it is possible that Microsoft support cannot find your account. They will contact you to confirm the account's existence with the following information :

1. Microsoft account ID (account alias)

2. Gamertag

3. Console ID

4. Proof of the existence of a Microsoft account – any notification that refers to a Microsoft account with the specified primary alias

5. Date of the last successful login you remember

C - Tips & Tricks

1 - Contacting Microsoft Support at any time

Depending on what time you are trying to contact the first level of Microsoft support, the callback option and/or the online chat may be closed. To contact support anyway, you can change your regional settings during step 9 (section II.A) by clicking "Want to change your regional settings?". Changing your language doesn't matter, as everything is translated into English anyway, but you can change your time zone to match business hours in said zone. That way, you'll be able to contact the account & billing service at any time of the day.

2 - Ensure that your case is correctly escalated

After creating a case by talking with an agent (level 1), you should receive an email from them within 72 hours. If that is not the case, you should retry the procedure because the agent didn't escalate your case to level 2. You can also ask for your case status by contacting another agent and providing them with your case number.

3 - Keep track of your requests

As we discussed, you may need to try different procedures or make several attempts. Each time you talk with an agent, you get a ticket number. Keep them all in a secure place! You can give them to level 1 agents so they can look at your previous conversations with other agents, and check the actions that followed. Knowing your request history may be useful if an agent asks for it or if you need to explain what you have already attempted.

4 - Keep contact with the same agent

When you start a new call/online chat with the first level of support, you are directed to the next available random agent. You can't ask them to be redirected to a specific agent, as they cannot do so. You can only provide new agents with your past ticket number so they can look at it.

The best way to keep contact with the same agent is to reply to their email that you should have received upon your case’s creation.

You can also ask for a rejoin link when chatting with an agent. This link will allow you to rejoin the conversation if you want to continue it later.

Another way is asking another agent to notify [agent name] handling [case number] to reply to your email/contact you.

5 - Attach any relevant files at all times

When contacting the account & billing service or when replying to the top-level support, you should always attach as much evidence as you can. In your response, insist that they look at the attachments. It will help you prove your statement.

D - About the data transfer

When 2FA has been enabled by the hacker, you can only access your games again by initiating a data transfer procedure (see sections I.B and I.C). If your account is tied to a console, your data can likely be transferred, as there are several cases on the Internet mentioning that they got their account back that way. I also discussed it with several Xbox support agents, who confirmed the procedure's existence for Xbox console owners.

Now, if your account isn't tied to a console, the data transfer procedure is your only option. The procedure exists, and the agent handling your case is likely to tell you that they need to determine your ownership of the account to transfer the data (or you can ask them if they plan on transferring your data). However, I have never seen any public cases where someone who didn't own a console ever got their data transferred. I don't want to sound like it is impossible, but it is unlikely to happen. If you get your data transferred, and you don't own a console, please make a post or contact me so I can update this thread!

IV - SUBJECTIVE PART : Quality of Service

I did my best to provide objective facts in the previous sections. Now, Microsoft support has a reputation for being a bad service, so this section will be a subjective one, as I will share some information with you that I have gathered during the 8 months I have spent with Microsoft support.

A - About the waiting times

Every agent will tell you that you will receive a response from the top-level support in 24-72 hours. While it is true most of the time, this delay can become much longer. It sometimes took 3 weeks for my SIR ticket to be handled, and sometimes I would never receive a reply at all. My best advice here is :

- If you don't receive a response from the top-level support after a month, you'll never get a reply, and you should restart the procedure.

- If you don't receive a response from the first level of support within 72 hours, it is unlikely that you'll get a reply, and you should restart the procedure.

B - About the agents' ability to do their job

Each time you contact the first level of support, you get a random agent. It is like playing the lottery; sometimes you'll get a serious person willing to help you who knows how to do their job, and sometimes you'll get someone without the required knowledge/motivation to help you.

I have met unhelpful agents :

- Some sleep during calls (I could hear them snoring, they forgot to mute their microphone.)

- Some that hung up on you

- Some don't know the procedure

- Some that won't escalate your case

I have met very helpful agents :

- They understand your problem

- They are motivated to help you

- They know the procedures

- They correctly escalate your case

I know they may not get paid enough to do their job, but that prevents someone from getting help. My advice is to keep contact with the agent you know is competent/motivated enough to help you.

The main problem with this is that you have incompetent/competent agents at all support levels, and you often need to pass all 3 levels to get the procedure done. That means that you need to be lucky enough that each agent at each level cares enough/is skilled enough to properly handle your issue.

C - You can rarely trust the agents

During my journey with Microsoft support, I talked with at least 50 representatives. I met several of them who straight-up lied to me, so they can skip to another ticket. As an example, some agents often proposed me that I get a call back from their seniors, but such a call never came. They told me it was impossible to handle my issue, but in the end, it got resolved (by another agent), and some other agents redirected me to different forms that didn't apply to my issue, etc. You get the picture; some agents just lie out of ignorance or malice.

It also happens that they contradict themselves in the same chat.

My advice is to cross-reference the sources. If you have a question, don't stop at the first reply you get; you should ask other agents to ensure you get the right answer.



D - Human-handled forms are inconsistent

I'll be quick; I have submitted several reinstatement forms, and privacy requests the same way each time, and sometimes I didn't get the same response. If you fill out the reinstatement form or the privacy form, and you receive a response saying that they can't help you, retry the form. You just had a bad lottery ticket; maybe next time, the person handling your form will do their job.

E - About their automated translation

During online chat, everything you say is translated into English, and everything the agent says is translated into your selected language. The automated translation is terrible, and it can hinder your conversation. Therefore, I recommend speaking in English when typing, and I advise you to read the original response from the agents.

F - They don't look into details

When filling out forms, following procedures, or replying to the top-level support email, you provide a detailed description of your situation with relevant attachments. Unfortunately, it often happens that agents don't bother to read the description you give and resolve your case based on the mandatory questions. This can prevent you from getting your case resolved at all because crucial details aren't taken into account.

In the end, having to deal with Microsoft support is exactly like asking for permit A38 (cf. The Twelve Tasks of Asterix). Most of the time, agents are unhelpful, and their procedures are designed to make you give up. However, that doesn't excuse any bad behavior when interacting with agents. Be nice to them, and you will have better chances of getting your issue resolved.

V - What you can do to secure your account

First, you can follow the best practices to avoid being compromised in the first place :

- Have a strong password (12 characters minimum, containing uppercase and lowercase letters, numbers, and symbols)

- Enable 2FA

- Have at least 3 security options on your account (recovery email, recovery phone, authenticator app)

- Note your backup code in case you lose your second factor

- Never share your account details/2FA codes with anyone

- Avoid clicking on sketchy links

- Avoid downloading suspicious files

Then, you can prepare yourself to answer a maximum of the account ownership questions (see section III.A). If you can't answer one of them, be sure to get the information or fill it in before it is too late. I am not telling you to give all your data to Microsoft; you just need to prepare your answers, just in case.

CONCLUSION

To conclude, getting access to a compromised account is very difficult, and getting your data transferred requires a lot of perseverance to get the procedures to their end. In most cases, the data transfer may not work, and the only thing you'll have done is get your account permanently suspended. However, that will prevent the hacker from getting money from your account and maybe lower their incentive to steal accounts.

I hope that I have helped you seek help from Microsoft support. If you read my entire essay, thank you! I am very grateful!

Please feel free to give feedback on this guide, and don’t hesitate to share how your case was resolved. I am looking to continually improve this guide.

Anyway, next time you see someone asking for help with a compromised account, kindly redirect them here.

I wish good luck to anyone dealing with Microsoft support, and I look forward to hearing your feedback.

P.S. : Don't hesitate to reply and/or share this post to help as many people as you can!

:)