How to Recover Your Outlook / Hotmail Account After Being Hacked

Open a browser on your PC and go straight to account.microsoft.com. When it asks you to sign in, choose Windows Hello (or a passkey) and verify with your PIN, face or fingerprint. Because Hello is tied to this device, it signs you in without the password — even if the attacker changed it.

If your PC's already signed in, even better — you're in. If you can't get in on the PC at all, use Path 2.

You're already in your account — now reset your password:

1. Open the Security tab, then Manage how I sign in
2. Under Ways to prove who you are → Enter password, choose Change password
3. Because Windows Hello already verified you, it won't ask for your old password — just enter a strong new one, reenter it, and Save

Changing it stops the attacker signing in with the old password.

While they were in, the attacker may have quietly added their own email, phone or app under Ways to prove who you are — a backdoor to reset your password all over again later. Clear it out:

1. On the Ways to prove who you are list, read every entry carefully
2. For anything you don't recognise — an unfamiliar email, phone number, authenticator or passkey — choose Remove

Leave only the methods you set up yourself. This shuts the door the attacker propped open.

Changing your password doesn't always end the attacker's existing sessions, so force everyone out:

1. On the Security page, scroll down to the Sign out everywhere section
2. Click Sign out everywhere and confirm

This signs you out of every browser, app and device your account is used on, where possible, within 24 hours — you'll just sign back in on yours. While you're there, glance over your recent sign-in activity for anything unfamiliar.

Before you go near the recovery page, pick up a device and browser you've signed in with before — ideally on your home network. Microsoft trusts familiar devices, browsers and networks far more, and that can be the single biggest factor in getting back in.

Now recover the account and prove it's you. Microsoft will offer whatever verification options are on the account — try any of them you can still access:

1. Go to account.live.com/password/reset and enter your Outlook, Hotmail or Live address
2. On Verify your identity, Microsoft asks for a code from your authenticator app first — if you have it, enter it and continue
3. If not, choose Use a different verification option, then pick Email a code or Text a code, confirm the address or number and select Get code
4. Enter the code Microsoft sends you and select Next

If you ever generated and saved your 25-character recovery code (Microsoft offers one when you turn on extra security), that's another way in — choose Use a different verification option and enter it. An authenticator app, passkey or recovery code is the fastest and strongest; use whichever you still control.

Recovery ends by having you set a new password — make it long (16+ characters), unique to this account, and saved in a password manager. To change it again at any time, go to Security → Manage how I sign in (shown below):

1. Open the Security tab, then Manage how I sign in
2. Under Ways to prove who you are → Enter password, choose Change password
3. Enter your new password, reenter it, and Save

A fresh password the attacker doesn't know locks them out of the front door.

While they had access, the attacker may have quietly added their own email, phone or app under Ways to prove who you are — a backdoor to reset your password all over again later. Clear it out:

1. Open Security → Manage how I sign in and read every entry under Ways to prove who you are
2. For anything you don't recognise — an unfamiliar email, phone number, authenticator or passkey — choose Remove

Leave only the methods you set up yourself. This shuts the door the attacker propped open.

Resetting your password doesn't always end the attacker's existing sessions, so force everyone out:

1. On the Security page, scroll down to the Sign out everywhere section
2. Click Sign out everywhere and confirm

This signs you out of every browser, app and device the account is used on, where possible, within 24 hours — you'll just sign back in on yours. While you're there, glance over your recent sign-in activity for anything unfamiliar.