Microsoft Account Locked? How to Unlock Outlook and Hotmail

You open Outlook, Hotmail or the Xbox app and, instead of your inbox, Microsoft says "Your account has been locked". Some versions add that Microsoft detected activity that violates its Services Agreement. Your email, OneDrive files and every login tied to that address are suddenly out of reach.

The short answer: sign in at account.microsoft.com and complete the check Microsoft puts in front of you. If you see a "Let's prove you're human" option, that is Microsoft's own route to unlocking the account. If there is no such option, the lock is stricter. Use the link beginning aka.ms/ in the lock window, submit the reinstatement form once, and wait for Microsoft's review.

This guide explains the different lock and block messages, what to do for each, what "usage limit exceeded" points to, and the fake support numbers aimed at people who have just been locked out.

Last checked: 29 September 2026.

#What Should You Do If Microsoft Says Your Account Has Been Locked?

Screenshot the message, then sign in at account.microsoft.com yourself. Microsoft's page on a locked Microsoft account says the lock means activity on the account might violate its Terms of Use. If a "Let's prove you're human" option appears, complete it. If not, Microsoft says the account was locked for suspicious activity or a Terms of Use violation, and you should follow the aka.ms/ link in the window to request reinstatement. Submit one request only. Nobody outside Microsoft, including AwareXone, can lift the lock for you.

#Locked, Blocked or Hacked: Which Microsoft Message Do You Have?

People call several different Microsoft screens "locked", and each has its own fix. The wording varies by app, language and region, so match on the key words rather than an identical sentence.

#Why Microsoft Locks Accounts

A lock is Microsoft enforcing the Code of Conduct in its Services Agreement, effective 30 September 2025. Microsoft's locked account page lists common causes: malware, phishing, spoofing Microsoft's networks, and spam in any form, from unwanted emails to reviews. It also warns against creating accounts with scripts or bots, reusing sign-up details across accounts, and using multiple accounts to break its policies.

A lock is not always proof that you did something wrong. If someone else got into your account and sent spam, that can look the same to Microsoft's systems as spam you sent yourself. Microsoft's page also says not every lock happens for the reasons it lists.

#How to Clear the Lock Yourself at account.microsoft.com

If Microsoft offers you a check, you can usually handle this alone in a few minutes. Work through it calmly on a device and network you normally use.

1. Type account.microsoft.com into your browser yourself. Do not follow a link from an email or text message.
2. Sign in with the locked address. If the page shows "Let's prove you're human", complete that check.
3. If the screen asks for a phone number to receive a security code, use a mobile number that can receive SMS today. Microsoft says VOIP numbers cannot receive its verification codes.
4. Enter the code exactly as it appears in the message. If Microsoft asks you to create a new password, choose one you have never used anywhere else.
5. Once in, open the Security page and check that every phone number and email listed as security info belongs to you.

For Outlook.com, Microsoft's page on how to unblock an Outlook.com account describes a temporary block after unusual sign-in activity. It starts from the same Sign-in Helper and asks you to enter a security code or change your password. If that still fails, the page sends you to Microsoft's guide for when you can't sign in.

#What "Usage Limit Exceeded" Means When You Ask for a Code

It means Microsoft has stopped sending codes for now, usually because too many were requested. Microsoft's help pages do not quote the phrase itself, but its verification code troubleshooting page explains the causes. Excessive or repeated requests to phones or email addresses can lead to temporary or permanent blocks. Activity that looks unusual, or heavy compromised traffic from your area, can also pause codes. Microsoft suggests these steps:

1. Stop requesting codes. Microsoft says repeated attempts may reset any time lock.
2. Try another verification method on the account, such as an alternate email instead of SMS.
3. Try another network, for example switch from Wi-Fi to mobile data.
4. Wait. Microsoft says a day is sometimes enough, and if nothing changes after 24 hours, to wait as long as possible, up to one week.
5. Then try the Sign-in Helper again from your usual device.

Also check the simple causes Microsoft lists: a phone that blocks texts from unknown numbers, or a full message inbox. In Malaysia, make sure a prepaid line has not expired. Microsoft says it will phase out SMS for personal accounts, so add another method once you are back in.

#No "Let's Prove You're Human" Option? Use the Reinstatement Link

If the lock screen offers no check, Microsoft treats it as a stricter lock. Its locked account page says to select the link in the window that begins with aka.ms/ and follow the instructions. That link opens Microsoft's Request for Account Reinstatement form, which says accounts may be disabled for suspicious activity, unsolicited email, or content that breaches the Code of Conduct.

At the time of writing, the form asks for the locked account's email, phone number or Skype username, the name on the account, a contact email, the account type, the login problem from a short list, any additional details, and a statement that you are the account holder.

Microsoft's support page says a Microsoft Online Safety support agent reviews the form and replies by email, and that extra requests may slow the response. The form itself says Microsoft may not contact you directly and gives no status updates. No review time is published, so do not read silence as a refusal.

#Checklist Before You Submit the Reinstatement Form

• A screenshot of the lock screen, with the date and the full aka.ms/ link visible.
• The locked address typed exactly, including the domain (outlook.com, hotmail.com, live.com or a country version).
• A contact email that is not the locked account and that you check every day.
• Three to five calm, factual sentences: when the lock appeared, what you use the account for, and anything unusual you noticed beforehand.
• If you found a likely cause, such as a bulk mailing tool, a shared computer or a suspected break-in, say so and say what you changed.
• Nothing sensitive. The form asks you not to include personal or sensitive information, so leave out passwords, codes and MyKad numbers.
• One submission only. Note the date so you can wait patiently instead of resubmitting.

#Mistakes That Keep a Microsoft Account Locked

• Sending the reinstatement form again and again. Microsoft says additional requests may slow its response.
• Hammering "resend code". Microsoft says repeated requests can cause blocks, sometimes permanent ones.
• Changing all your security info at once after you get back in. Microsoft says that can restrict the account for 30 days.
• Using an internet calling or virtual number for codes, which Microsoft does not accept.
• Asking a support agent to unlock the account. Microsoft says its agents cannot send password reset links or change account details outside the reinstatement form.
• Opening a new account to get around the lock. Microsoft's page lists using multiple accounts to break its policies as a cause of locks.

#Is the Lock Really a Hack?

Sometimes the lock is Microsoft reacting to someone else. Signs include a password that stopped working, security info you did not add, codes you did not request, or sent emails you never wrote. Microsoft says an unrequested code may mean someone is trying to get in, and you should not respond to it.

A takeover needs a different route, built around password reset and the account recovery form. Our guide to recovering a hacked Microsoft account covers that step by step. If you only saw an unfamiliar sign-in alert, read what to do when someone logged into your account first.

#Fake Microsoft Support Numbers and Remote-Access Scams

A lock is exactly the moment tech support scammers wait for. Microsoft's page on tech support scams is direct: its error messages never include phone numbers, it does not make unsolicited calls to fix your computer, and it never asks for payment in cryptocurrency or gift cards. Scammers spoof caller ID, show fake pop-ups that seem to lock your browser, and ask you to install a remote access app.

In Malaysia the script arrives by call or text in English, Bahasa Malaysia or Chinese, for example "Akaun Microsoft anda telah dikunci, sila hubungi kami segera" with a number to call. Treat it as a scam, whatever the caller ID shows.

#If You Paid a Scammer or Let Them Into Your Computer

Microsoft's scam page says to uninstall any app the scammer asked you to install, consider resetting the device, run a full scan with Windows Security, apply updates, change your passwords and call your card provider to contest charges. You can report the scam at microsoft.com/reportascam.

If money left your bank account, act on that first. The NSRC's FAQ on the NFCC website says to call your bank's 24-hour hotline or the NSRC on 997. Then make a police report at the nearest station within 24 hours. The NSRC also says it, PDRM, MCMC, BNM and banks will never ask for your password, PIN, TAC or OTP. Fake support websites and phishing pages can be reported to CyberSecurity Malaysia's Cyber999 incident response centre by online form, email, phone or its app.

#After You Get Back In

• Review your security info and add a second method, such as an authenticator app, since Microsoft is phasing out SMS for personal accounts.
• Update security info one item at a time to avoid the 30-day restriction.
• Sign in at least once every two years. The Services Agreement says Microsoft closes accounts it treats as inactive.
• Check which social media accounts use this address as their login email. If one slipped out of reach while the inbox was locked, see our guide to recovering an account without the old email or phone.

#What If Microsoft Keeps the Lock?

Microsoft makes the final decision, and some locked accounts do not come back. The Services Agreement says that if you break its terms, Microsoft may limit features, stop providing services, close the account immediately or block communications. Closing an account may mean losing content licences, associated content, memberships and balances, which is why one careful request matters more than a fast one.

#When a Case Review Makes Sense

Most Microsoft locks can be handled alone. A second opinion helps when a lock and a takeover are tangled together, or when the locked address is the login email for your business pages. SocialSafe by AwareXone, our recovery service, looks at the case before anything is agreed and uses only Microsoft's own forms; sometimes the honest answer is that you already have what you need. You can read about our account security work, and our Trust Center explains why we never ask for your password or codes.

#Frequently Asked Questions