# Microsoft Account Hacked? How to Recover Outlook or Hotmail

> Microsoft, Outlook or Hotmail account hacked? Scan for malware, reset the password, then use the recovery form at account.live.com/acsr. Malaysia steps too.

- URL: https://www.awarexone.com/research/microsoft-account-hacked-recovery
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026-09-29
- Topics: Microsoft, Account recovery, Malaysia
- Related service: Account security: https://www.awarexone.com/services/account-security

## Short answer

Run a full malware scan first, then use Microsoft's official routes in order: a password reset, the sign-in helper, then the account recovery form. On the form, give a different working email and add old passwords and exact subject lines. Microsoft replies within 24 hours, and only Microsoft decides whether the account comes back. Never share a code.

## Summary

- A hacked Microsoft account comes back only through official routes: a password reset, the sign-in helper, then the account recovery form.
- Run a full malware scan first, because a new password typed on an infected computer can be stolen again straight away.
- On the recovery form, give a different working email, use a device and place you signed in from before, and add old passwords and exact subject lines.
- Microsoft replies to that email within 24 hours, you can try up to two times a day, and its support agents cannot reset the account for you.
- Once you are back in, sign out everywhere, delete forwarding and inbox rules you did not set, fix your security info and turn on two-step verification.
- Anyone phoning as Microsoft support or selling recovery is not legitimate, never share a code, and only Microsoft decides whether the account comes back.

Your Outlook or Hotmail password has stopped working, friends are asking about strange emails from you, or Microsoft warned you about a sign-in you did not make. When you try to reset the password, the code goes to a phone number or email you have never seen.

The short answer: a hacked Microsoft account is recovered through three official routes, tried in order. A password reset, then Microsoft's sign-in helper, then the account recovery form at account.live.com/acsr. Before any of them, scan the computer you will use, because a new password typed on an infected machine can be stolen again.

This guide covers each route, how to fill in the recovery form, what to fix once you are back in, and the fake support lines aimed at you. If Microsoft locked the account rather than someone taking it, read our guide to [a locked Outlook or Microsoft account](https://www.awarexone.com/research/outlook-microsoft-account-locked) instead.

Last checked: 29 September 2026.

## How Do You Recover a Hacked Microsoft Account?

Run a full malware scan, then select "Forgot my password" on the Microsoft sign-in page and, where it appears, "I think someone else is using my Microsoft account". If the codes go to contact details the attacker added, use Microsoft's sign-in helper, then the recovery form with a different working email address. Microsoft replies to that address within 24 hours, and you can try up to two times a day. Its support agents are not allowed to send reset links or change account details, so nobody on a phone line, including AwareXone, can hand the account back.

## Which Situation Are You In?

Match what you see to a row below before you start. Screen wording can vary by device, language and region, so go by the key words.

*Common Microsoft account messages after a takeover and the first step for each, based on Microsoft Support pages at the time of writing.*

| What you see | What it usually means | Where to start |
| --- | --- | --- |
| An email or text about an unusual sign-in, but you can still sign in | Someone may have your password; you still control the account | Open Recent activity, select "This wasn't me" or "Secure your account", then change the password |
| Your password stopped working, but the reset options are still your own email or phone | Someone changed the password but not the security info | Reset the password with a code sent to your own contact details |
| The reset screen hints at an email or phone number you do not recognise | The attacker added their own security info | Use the sign-in helper, then the account recovery form |
| "Your security info change is still pending" or "You can't access this site right now" | All security info was removed and replaced, which starts a 30-day restricted state | If it was not you, select "let us know" on that window |
| Two-step verification is on and you cannot reach any of your methods | Microsoft says it cannot help in this case | Try every method you ever set up, including a saved recovery code |
| A message that your account has been locked, or a Services Agreement notice | A lock applied by Microsoft, which is a different process | Follow our locked account guide instead of the recovery form |

## Step One: Clean the Device Before You Change the Password

Microsoft's page on [recovering a hacked or compromised account](https://support.microsoft.com/en-us/account-billing/how-to-recover-a-hacked-or-compromised-microsoft-account-24ca907d-bcdf-a44b-4656-47f0cd89c245) puts this first, before any password change. If malware is logging your keystrokes, the new password goes straight to the attacker.

1. Open Windows Security and go to the "Virus & threat protection" tab.
2. Select "Scan options", then "Full scan", then "Scan now".
3. If you use another antivirus app, run its full scan instead. Microsoft says to do this whichever app you have.
4. If someone claiming to be support had you install a remote-access app, Microsoft's [tech support scam guidance](https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435) says to uninstall it and consider resetting the device.

## Route One: Reset the Password

A reset works when at least one security contact on the account is still yours. Microsoft's page on [resetting a forgotten password](https://support.microsoft.com/en-us/account-billing/reset-a-forgotten-microsoft-account-password-eff4f067-5042-c1a3-fe72-b04d60556c37) sets out the steps:

1. On the sign-in page, select "Forgot password?", or open Microsoft's reset page, enter the account email or phone, and select "Next".
2. Choose where to receive a verification code.
3. Retype the first part of the email address, or the last four digits of the phone number, that Microsoft hints at, then select "Get code".
4. Enter the code and set a new password you have never used anywhere else.

If that fails, Microsoft's page on [unusual sign-ins](https://support.microsoft.com/en-us/accounts-billing/security/what-happens-if-there-s-an-unusual-sign-in-to-your-account) says to go back to the sign-in page, select "Forgot my password", then "I think someone else is using my Microsoft account", and follow the instructions. With two-step verification on, you need two contact methods to reset, according to Microsoft's [two-step verification page](https://support.microsoft.com/en-us/accounts-billing/security/how-to-use-two-step-verification-with-your-microsoft-account).

If you once printed a 25-digit recovery code, use it now. Microsoft's [recovery code page](https://support.microsoft.com/en-us/accounts-billing/manage/how-to-get-a-microsoft-account-recovery-code) gives the path: "Other ways to sign in", "Use my password", "Forgot password?", "Use a different verification option", "I don't have any of these", then enter the code at "Do you have an account recovery code?". Microsoft notes that with two-step verification on, the changes take 30 days to apply.

## Route Two: The Sign-in Helper

Microsoft points you to its sign-in helper when there is no option to send a code, or when you no longer have or recognise the options shown. The tool asks for your email address or phone number, then shows self-help or offers the chance to talk to an agent. Open it from Microsoft's own support page, never from a search advert or a message.

## Route Three: The Account Recovery Form

The [account recovery form](https://account.live.com/acsr), titled "Recover your account", is the route when the attacker controls every contact method. Microsoft's [help page for the form](https://support.microsoft.com/en-us/accounts-billing/manage/help-with-the-microsoft-account-recovery-form) says it asks questions only the owner should be able to answer, that it can be a lengthy process, and that Microsoft reviews the answers and replies within 24 hours. Prepare before you open it.

## Evidence Checklist for the Recovery Form

- A working email address that is not the hacked account. Microsoft says any active address will do, even a friend's or relative's, or a new free outlook.com account. It is used only for this request.
- A device and place Microsoft will recognise: a computer or phone you signed in on before, at the home or office where you normally use it.
- Every old password you can remember for this account, plus passwords you reuse elsewhere. Check what Edge, Chrome or your Apple keychain has saved.
- Exact subject lines of emails you sent recently. Microsoft says they must be exact, so ask friends to find a message from you and copy the subject word for word.
- Email addresses of people you wrote to often from the account.
- The exact address. Microsoft notes some domains are country specific, such as @outlook.co.uk.
- The details you gave at sign-up, which may differ from today, such as an older name or address.
- If you played on Xbox, the hardware ID of the console you use most.

Answer every question you can. Microsoft says guessing is fine and wrong answers do not count against you. Where the form lets you "add more", add more.

## What Happens After You Submit

Microsoft sends the result to your working email within 24 hours. If it verified you, that email explains how to sign back in. If not, you can try again, up to two times a day. Make each attempt carry more detail than the last, such as another old password or a subject line a friend found.

> Note: **The limit Microsoft states plainly.** Microsoft's form help page says that if two-step verification was on and you cannot reach any alternate verification method, "we cannot help you, sorry". Some hacked accounts do not come back. The decision is Microsoft's alone, and no outside service can change it. Our guide to [recovering accounts without the old email, phone or 2FA](https://www.awarexone.com/research/lost-email-phone-2fa-account-recovery) covers what is still worth trying.

## The 30-Day Wait: "Your Security Info Change Is Still Pending"

Attackers often strip out your security info and add their own. Microsoft's page on [pending security info changes](https://support.microsoft.com/en-us/accounts-billing/manage/what-does-security-info-change-is-still-pending-mean) says that when all security info is removed, the account enters a restricted state for 30 days, and Microsoft sends notifications to the original phone or email during that time.

- If you did not make the change, sign in to the Security page of your Microsoft account and select "let us know" at the bottom of the pending window.
- Microsoft says it cannot shorten the 30 days unless the request is cancelled, and cancelling needs access to the old security proofs.
- During the wait you can still use most services, such as Outlook.com and OneDrive, but you cannot update the password, aliases or parental controls.

## Once You Are Back In: Close Every Door

Getting the password back is half the job. Microsoft's hacked account page asks you to check connected accounts, forwarding and automatic replies, because a forwarding rule can keep copying your mail to the attacker after the password changes.

1. Review your [Recent activity page](https://support.microsoft.com/en-us/accounts-billing/security/what-is-the-recent-activity-page), which shows the last 30 days. Expand each entry; in "Unusual activity" select "This wasn't me", and for anything odd under "Recent activity" select "Secure your account".
2. Use [Sign out everywhere](https://support.microsoft.com/en-us/accounts-billing/manage/how-to-sign-out-of-your-microsoft-account-everywhere) under Advanced security options. It takes up to 24 hours and does not cover an Xbox console.
3. In Outlook.com, open Settings, then Mail, then "Forwarding and IMAP", select "Disable forwarding" and save. Microsoft's [forwarding page](https://support.microsoft.com/en-us/outlook/mail/turn-automatic-forwarding-on-or-off-in-outlook) shows the same path.
4. In Settings, then Mail, then Rules, delete any rule you did not create, especially ones that forward, redirect, move or delete mail. Microsoft's [rules page](https://support.microsoft.com/en-us/outlook/mail/manage-email-messages-by-using-rules-in-outlook) explains each control.
5. Under "Manage how I sign in", remove phone numbers and emails you do not recognise and add your own. Microsoft advises against changing all security info at once, which would start the 30-day wait again.
6. Turn on two-step verification from the same page and keep several methods. Microsoft's [account security tips](https://support.microsoft.com/en-us/account-billing/how-to-help-keep-your-microsoft-account-safe-and-secure-628538c2-7006-33bb-5ef4-c917657362b9) say an extra way to sign in makes a hacked account easier to recover. Microsoft recommends three pieces of security info, and it is phasing out SMS for personal accounts, so favour the Authenticator app or a second email.
7. Generate a new recovery code, print it, and keep it off any device you sign in with, as Microsoft's recovery code page advises.

## Check the Accounts That Rely on Your Outlook Address

Your Outlook inbox is probably the recovery email for Facebook, Instagram, shopping and bank alerts, and the attacker could have reset any of them. Search the inbox and deleted items for "password reset" or "email changed" messages you did not trigger, then secure each account. Our guide to [what to do when someone logged into your account](https://www.awarexone.com/research/someone-logged-into-my-account) walks through that check.

If the takeover started with a link that asked you to "verify" your mailbox, read [what to do after clicking a phishing link](https://www.awarexone.com/research/clicked-phishing-link-what-to-do). If your phone suddenly shows "No service" while codes stop arriving, call your carrier from another phone and ask whether your SIM was replaced.

## Mistakes That Sink a Recovery Attempt

- Changing the password on a computer you have not scanned.
- Giving the hacked address as the contact email on the recovery form.
- Filling in the form on a borrowed laptop when a device you used before is at home.
- Resubmitting the same thin answers instead of adding new detail.
- Stopping at the password and leaving forwarding rules and old sessions in place.
- Calling a support number from a pop-up, an advert or an unsolicited message.

> Warning: **Fake Microsoft support and "recovery experts".** Microsoft says its error and warning messages never include phone numbers, that it does not make unsolicited calls to offer support, and that it never asks for payment in gift cards or cryptocurrency. Its own agents are not allowed to send reset links or change account details, so a stranger charging to restore your account cannot do what Microsoft's staff may not. Real security emails come from account-security-noreply@accountprotection.microsoft.com. Never share your password, a verification code or a recovery code, never install a remote-access app for a caller, whatever language they speak, and report the scam at [microsoft.com/reportascam](https://www.microsoft.com/en-us/reportascam).

## If Money Was Lost or a Code Was Shared in Malaysia

Deal with the money first. The NSRC's [FAQ on the NFCC website](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) says to call your bank's 24-hour hotline or the NSRC on 997 as soon as you notice an unauthorised transaction, then make a police report at the nearest station within 24 hours. It also says NSRC, PDRM, MCMC, BNM and banks will never ask for your password, PIN, TAC or OTP.

If you paid a fake support caller by card, Microsoft's scam guidance says to call your card provider and contest the charge. A phishing email or fake Microsoft login page can be reported to CyberSecurity Malaysia's [Cyber999 incident response centre](https://www.cybersecurity.my/portal-main/services/cyber999-overview) by online form, email, phone or its mobile app.

## When a Case Review Makes Sense

Many people recover a Microsoft account alone with the routes above, and only Microsoft can restore one. A second opinion helps when the form keeps failing or when several accounts hang off the same inbox. SocialSafe by AwareXone, our recovery service, reviews the case first and tells you honestly whether an official route is still open. You can read how our [account security service](https://www.awarexone.com/services/account-security) works, and our [Trust Center](https://www.awarexone.com/trust) sets out what we will never ask for, starting with your password and codes.

## Frequently Asked Questions

### Can I call Microsoft to get my hacked account back?

You can contact Microsoft Support, but Microsoft says its agents are not allowed to send password reset links or access and change account details. The reset flow, the sign-in helper and the recovery form are the routes that can restore access.

### How long does the Microsoft account recovery form take?

Microsoft says it sends the result to your working email within 24 hours. If it could not verify you, you can submit again, up to two times a day.

### Why does my Microsoft recovery form keep getting rejected?

The form compares your answers with what Microsoft holds, so thin or approximate answers often fail. Add exact subject lines, more old passwords and contacts, and submit from a device and place you used before.

### Is an email saying someone signed in to my Microsoft account real?

Microsoft says genuine alerts come from account-security-noreply@accountprotection.microsoft.com. Either way, you can sign in to your account directly, without clicking the email's links, and check the Recent activity page.

## Official sources

- [Microsoft Support: How to recover a hacked or compromised Microsoft account (read 29 September 2026)](https://support.microsoft.com/en-us/account-billing/how-to-recover-a-hacked-or-compromised-microsoft-account-24ca907d-bcdf-a44b-4656-47f0cd89c245)
- [Microsoft Support: Help with the Microsoft account recovery form (read 29 September 2026)](https://support.microsoft.com/en-us/accounts-billing/manage/help-with-the-microsoft-account-recovery-form)
- [Microsoft: Recover your account form (read 29 September 2026)](https://account.live.com/acsr)
- [Microsoft Support: Reset a forgotten Microsoft account password (read 29 September 2026)](https://support.microsoft.com/en-us/account-billing/reset-a-forgotten-microsoft-account-password-eff4f067-5042-c1a3-fe72-b04d60556c37)
- [Microsoft Support: What happens if there's an unusual sign-in to your account (read 29 September 2026)](https://support.microsoft.com/en-us/accounts-billing/security/what-happens-if-there-s-an-unusual-sign-in-to-your-account)
- [Microsoft Support: What is the Recent activity page? (read 29 September 2026)](https://support.microsoft.com/en-us/accounts-billing/security/what-is-the-recent-activity-page)
- [Microsoft Support: How to use two-step verification with your Microsoft account (read 29 September 2026)](https://support.microsoft.com/en-us/accounts-billing/security/how-to-use-two-step-verification-with-your-microsoft-account)
- [Microsoft Support: How to get a Microsoft account recovery code (read 29 September 2026)](https://support.microsoft.com/en-us/accounts-billing/manage/how-to-get-a-microsoft-account-recovery-code)
- [Microsoft Support: What does "Security info change is still pending" mean? (read 29 September 2026)](https://support.microsoft.com/en-us/accounts-billing/manage/what-does-security-info-change-is-still-pending-mean)
- [Microsoft Support: How to sign out of your Microsoft account everywhere (read 29 September 2026)](https://support.microsoft.com/en-us/accounts-billing/manage/how-to-sign-out-of-your-microsoft-account-everywhere)
- [Microsoft Support: Turn automatic forwarding on or off in Outlook (read 29 September 2026)](https://support.microsoft.com/en-us/outlook/mail/turn-automatic-forwarding-on-or-off-in-outlook)
- [Microsoft Support: Manage email messages by using rules in Outlook (read 29 September 2026)](https://support.microsoft.com/en-us/outlook/mail/manage-email-messages-by-using-rules-in-outlook)
- [Microsoft Support: How to help keep your Microsoft account secure (read 29 September 2026)](https://support.microsoft.com/en-us/account-billing/how-to-help-keep-your-microsoft-account-safe-and-secure-628538c2-7006-33bb-5ef4-c917657362b9)
- [Microsoft Support: Protect yourself from tech support scams (read 29 September 2026)](https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435)
- [Microsoft: Report a technical support scam (read 29 September 2026)](https://www.microsoft.com/en-us/reportascam)
- [NFCC: National Scam Response Centre FAQ (read 29 September 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc)
- [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 29 September 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview)

---

AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.