Hacked Child Account - hacker cancelled account recovery

RobertV · Sep 9, 2023

6 days ago a child account under my parent account was hacked. We are not sure how that occurred since 2 factor authentication was setup. Our only thought is that we used an app called Authy for 2 factor codes and maybe the id/pwd used for that was used elsewhere and was part of a breach. Otherwise we don't know.

The hacker changed the email immediately to a Russian email address and removed all of the security information but left 2 factor on with codes only going to a Russian email address.

The child noticed it within 45 minutes and I got a flood of emails saying all of the changes occurred.

We were able to initially use the account recovery to get partial control and change the password to one only we know.

We then however can't update the email back to the original one because that would require sending a code to the Russian email address. The process did allow us to submit a change that said it would take 30 days to take effect.

Today I received another email saying that account recovery was cancelled.

Now the login has changed to the Russian email address and there is no trace of the original email address.

If we try to update the email address again or any security information we get a message we must wait 30 days to even try to submit a change to restore the account.

What good is this if the hacker can just click somewhere to "cancel" the changes and we have to then keep waiting 30 days to try again?

I was able to call on the phone and the person I reached said they would create some sort of research or case but then subsequently DISCONNECTED US when I suggested I myself felt very uncomfortable with Microsoft's security since we don't know how this originally occurred or understand why account recovery doesn't allow us to get full control back.

Meanwhile we now have multiple computers that are hard to login to, XBOX issues and the inconvenience of all of this.

Anyone have any suggestions? I don't know if the person on the phone actually created a case. I got no emails from Microsoft and they just disconnected me so we were left hanging by this process.

:)

Kathy A.

Hello RobertV,

Thank you for posting in Microsoft Community.

We understand that you are trying to recover your child's account that was hacked. Just to set your expectation, Microsoft account is managed by a completely automated server and we do not have manual access to it. Microsoft takes the security and privacy of our customers very seriously. We are committed to protecting your personal information, and the meticulous account recovery process is intended to protect you from any possible malicious activity.

As per your description, the child's account information was changed into the hackers' details, and your account is no longer accessible to you. We appreciate your time posting, we would recommend you to reach out to our live support team to get into the details of your concern:

Provide the contact us link: Contact Microsoft Support

To connect to our accounts and billing department, follow the following:

Search for billing
At the bottom, click Contact support
From the menu, select Microsoft 365 and Office - Billing and Payment Updates
Click Confirm
Then click Chat with a support agent in your web browser

NOTE:

Please sign in to your Microsoft account so that you can schedule your call later in the day or chat immediately with an available support representative.
Our phone team business hours (all U.S. Pacific Time): * Monday to Friday: 06:00.m-22:00.m and * Saturday to Sunday: 07:00.m-18:00.m, chat team is 24:7.

Sincerely,

Microsoft Community Moderator

Georges C.

Hello again, when you start the account recovery process you must put the email you had before being hacked, not the email that was put by the hackers.

Amirul Arif1

Dear Tomm, non of the option above i can do since hacker manage to delete the email address i use on the hacked account (a***********@gmail.com)

and i was able to check the hacker email from my minecraft in android (f*********@gmail.com) that now linked to my hacked account (a*********@gmail.com)

is there anyway by only having hacker email info to recovery?

***Edit: removed personal identifiable information from post***

Darhyl Mayte Amizola

I understand, as hackers tend to secure the accounts that they have hacked but, you've got nothing to worry as your account can still be recovered.

Please give me an update here once you have received the results from the account recovery webform.

Steve_LB

Hi! Thank you for replying, but I have tried doing the account recovery countless times (you must have not read that in the OP). The first time I did it it worked, but the hacker canceled the recovery 30 day wait and now every time I do it, it just automatically declined me. I have a phone number that was linked to the account, but there is no where to put that on the account recovery forum.

Hacked Child Account - hacker cancelled account recovery