How to Recover Your Microsoft Account After Being Hacked

On the PC, browse to account.microsoft.com. At the sign-in screen, pick Windows Hello (or a passkey) and confirm with your PIN, face or fingerprint. The verification lives on this machine, so the password — whatever the attacker set it to — never comes into it.

Already signed in on the PC? Even simpler: you're in. If neither works, drop down to Path 2.

With the account open, replace the password:

1. Go to Security, then Manage how I sign in
2. Under Ways to prove who you are → Enter password, pick Change password
3. Hello already vouched for you, so no old password is needed — enter a strong new one twice and Save

The attacker's copy of the old password just became scrap.

Assume the intruder left themselves a spare key under Ways to prove who you are — their own email, number, authenticator or passkey, ready to reset your password next month:

1. Read the Ways to prove who you are list entry by entry
2. Remove anything you didn't add yourself — no matter how plausible it looks

When only your own methods remain, the propped-open door is shut.

A new password doesn't reliably end sessions that are already open — end them yourself:

1. Scroll the Security page to Sign out everywhere
2. Click it and confirm

Within 24 hours every browser, app and device is signed out where possible — the intruder included, while you simply log back into your own. Give the sign-in activity a quick once-over on your way out.

Where you attempt recovery matters as much as what you type. Use a device and browser this account has seen before, on your usual home network — familiarity carries more weight with Microsoft's checks than almost anything else you control.

Time to prove ownership — use whichever verification route you still hold:

1. Open account.live.com/password/reset and enter the account's address
2. Verify your identity asks for an authenticator app code first — supply it if you can
3. Otherwise pick Use a different verification option, then Email a code or Text a code, confirm the destination and hit Get code
4. Type the received code and continue with Next

A saved 25-character recovery code (offered when extra security was switched on) also works via Use a different verification option. Authenticator, passkey or recovery code are the strongest cards — play whichever is still in your hand.

Verification ends at the new-password screen: 16+ characters, unique to this account, straight into a password manager. Need to change it again later, it lives at Security → Manage how I sign in:

1. Open Security, then Manage how I sign in
2. Under Ways to prove who you are → Enter password, choose Change password
3. Enter it twice, Save

The front door now has a lock the attacker has never seen.

Whoever was inside probably left a way back — their own contact details planted under Ways to prove who you are:

1. Open Security → Manage how I sign in and inspect every listed method
2. Unfamiliar email, number, authenticator or passkey? Remove it

Only the methods you created should survive this pass.

The reset alone can leave the attacker's sessions breathing — finish them:

1. On Security, scroll to Sign out everywhere
2. Confirm it

All sessions on all devices end within 24 hours where possible; yours come back the moment you sign in again. Scan the recent sign-in activity before you leave.