PC Someone Changed Your Account Details: Recovering a Taken-Over Account
In plain English: This page is for that case, where someone else has taken over your Microsoft account and changed the details you need to sign in. It is a different problem from forgetting your own password or from an account that Microsoft has blocked.
First safe step: Before you try anything else, check your phone, tablet, and other PC for one that is still signed in to this account. If you find one, leave it signed in.
You type the password you know is right, and Microsoft says it is wrong. Then you see a notice that your password or security info was changed, even though you did not change it.
This page is for that case, where someone else has taken over your Microsoft account and changed the details you need to sign in. It is a different problem from forgetting your own password or from an account that Microsoft has blocked.
Work through it in order. First confirm the change, then try one password reset to see what it tells you, then use the recovery route if your security info is gone. Once you are back in, check recent activity and aliases before you clean up sessions, security settings, and mail rules.
Part of the Locked Out of Your Microsoft Account, Outlook or Windows? Recovery in Plain English series, the pillar guide for this cluster.
How to tell someone else changed your password
Start with the two signs together. You type the password you have used before, and maybe have written down, and Microsoft says it is wrong. Then you find an email or text from Microsoft saying your password, phone number, email address, or alias was changed, at a time you were not signing in.
Either sign on its own can have another cause. Together, they point to someone else getting in and changing the details to lock you out. Look for the exact wording in the message about what changed, and note the date and time. Do not click links in a message you are unsure about.
That is different from forgetting a password. With a forgotten password, there is no change notice and your old security info is still listed. It is also different from a blocked or locked account, where your password is often accepted but Microsoft stops the sign-in and gives a reason. Those cases follow different routes.
Before you try anything else, check your phone, tablet, and other PC for one that is still signed in to this account. If you find one, leave it signed in. Do not sign out to test the password. That open session can help show the account is yours in the steps ahead.
Try a password reset first and see what it proves
Start on a device and browser you trust, ideally one you have used to sign in to this account before. Type account.microsoft.com yourself in the address bar, try to sign in, and select Forgot password. Do not use a sign-in link from an email, text, or pop-up, even if it looks like a Microsoft warning, because a fake link can steal the code you are about to enter.
Microsoft will show where it can send a verification code. Read the partly hidden addresses and numbers with care. If you see your own phone number or email address, choose it, enter the code when it arrives, and move straight to the reset.
Create a new password you have never used on this account or anywhere else, and do not reuse an old one with a small change. Write it down on paper and keep it somewhere safe at home until you are back in, settled, and ready to save it properly. A reused password lets the other person guess their way back in.
If the only options belong to a stranger, or your own phone and email are gone, stop here. That screen is the proof your security info was replaced, and a reset code will go to the other person, not to you. Do not keep requesting codes or trying again, because repeated failed attempts can trigger sign-in limits and slow the next step.
Use the recovery route when your security info was replaced
Go to the Microsoft account recovery form at account.live.com/acsr, typed into a browser yourself. Start it from a phone, tablet, or computer you have used for this account before, and from home or another place where you usually sign in. Enter the account address and a different email address you can open now. Microsoft sends its decision to that contact address. Microsoft uses that history in its decision.
Give proof that links you to the account before the takeover: passwords you used before the change, earlier aliases you added or removed, Microsoft Store order dates and items, and Xbox details such as your gamertag and console. In the final box, name the phone, email, or alias changed and the date on Microsoft's change message. Do not guess at dates you can verify from receipts or messages.
If Microsoft approves the form, follow the link in the email sent to your contact address and set a new password you have never used before. Sign in, open your security settings, remove the stranger's phone and email, and add your own phone and email back. Remove any alias the stranger added, too. Replacing all the security info this way can start a wait of up to 30 days.
The wait does not lock you out again. You can sign in with your new password and use the account, but your new phone and email will not work for security codes for sensitive changes until the wait ends, and Microsoft will not shorten it. Keep your contact address open so you receive notices about the pending change. Save the date it is due to end.
If the form is refused, you are not done. You can submit it again when you have found new proof, such as an older password, an earlier alias, or a store receipt, up to twice a day. Sending the same answers again rarely changes the result, so wait until you can add something you did not include the first time.
Once you are back in, check recent activity and aliases first
Do these two checks before anything else, while the details are still in front of you. A new password alone does not show where the attacker used the account, or whether they added a name of their own to it. Recent activity answers the first question, and the aliases page answers the second.
- Type account.microsoft.com yourself and sign in. Select Security, then View my sign-in activity to open the Recent activity page. Start with the newest entries and work back to the date on Microsoft's change message, and a little before it.
Look for entries marked as a successful sign-in with a place, a device, or a time you do not know. A sign-in from a town you have not visited, or at a time when you were asleep, counts as unknown. Open any entry you do not recognize and select This wasn't me.
- Next, open the aliases page at account.live.com/names/manage, and sign in again if Microsoft asks. Read every alias on the list. Look for an address you do not recognize, and check which address is marked as the primary alias.
If the attacker's address is marked as primary, select Make primary next to your own address first. Then select Remove next to the attacker's address. Check the list again afterward, so your own address is the primary alias and no address you do not know is left.
Take care with your own addresses on that list. Never remove an Outlook.com or Hotmail.com alias that is yours, even an old one you no longer use, because removing it deletes that address for good. Write down the dates of the unknown sign-ins and alias changes. Banks or Microsoft may ask for them later.
Clean up in this order: sessions, security, then mail rules
With the activity and alias checks done, clean up in this order and do not skip ahead. A device that is still signed in can let the other person back in, even after a password change.
First, go to account.microsoft.com, select Security, then Advanced security options, and select Sign out everywhere. Sign back in only on devices you know are yours, one at a time.
Next, confirm your password is new, long, and not used on any other account. Check your security info, remove any phone or email that is not yours, and add only your own.
Turn on two-step verification in Advanced security options. When Microsoft offers a recovery code, save it. Write it down or print it and keep it somewhere safe at home, away from the computer, so you can get in if you lose your phone.
Now open Outlook.com. Select Settings, then Mail, then Forwarding, and turn off forwarding if you did not set it up. Then select Mail, then Rules, and delete any rule you did not make, especially a rule that forwards, moves, or deletes messages without you seeing them.
Check Sent items for messages you did not send. If contacts got a strange message from you, tell them your account was taken over and is now recovered, and warn them not to open links or files in that message. Ask them to delete it.
Then check money and devices at account.microsoft.com. Look at order history, Services and subscriptions, and Payment options for purchases, renewals, or stored cards you do not know. Cancel or remove what is not yours, and on the Devices page, remove any device you do not recognize.
Last, run a full scan on your own PC before you sign back in on it. Open Windows Security, select Virus and threat protection, then Scan options, and run Full scan. Let it finish and remove anything it finds.
If you cannot get the account back, protect everything around it
If the recovery decisions keep coming back refused, there is no other Microsoft route around them. No phone or chat agent can bypass the identity checks or hand the account back on request. Spending more time looking for a support shortcut will not change that answer.
Protect the accounts around it first. Change any password you reused on the lost account, starting with other email, banking, and shopping accounts, and use a different password for each one. If a payment card was stored on the lost account, tell your bank, ask what to watch for, and follow its advice about the card.
Warn family, friends, and other contacts that the old account is no longer yours. Tell them not to open links or files, send money, or share codes in messages from that address, and to reach you another way instead. Do this soon, before the account is used to reach them.
A new Microsoft account is the last resort. Purchases and saved games do not transfer to it, so keep your refusal messages and dates in case you need them later. Set up two-step verification on the new account on the first day, with your own phone and email.
Frequently asked questions
Can Microsoft support give my account back over the phone?
No. No phone or chat agent can bypass the identity checks or hand the account back on request. When your security info was replaced, the recovery form is the route to use.
Can I sign in during the up to 30 day wait after replacing security info?
Yes. The wait does not stop you signing in with the new password. The new security info just cannot be used for security codes for sensitive changes until the wait ends.
What if the recovery form is refused?
You can submit it again with new proof, up to twice a day. Add proof from before the takeover, such as an old password or an earlier alias, rather than sending the same answers again.
Conclusion
Getting back in is only half the job. A takeover means someone had time inside the account, so the checks after sign-in matter as much as the recovery form itself. If you worked through them in order, there should be no easy way left for that person to sign in again.
If recovery is still pending or was refused, keep going with the steps around the account and keep any notes you made about dates and changes. Keep those notes somewhere safe at home. They can help with a bank, a family member, or a later recovery attempt, and they save you from starting over from memory.