Windows 10: Microsoft Account hacked and taken over

This has been about the most absurd experience of my life dealing with security issues.


The short version: My main Microsoft account was taken over. Microsoft won't pick up phones and the one time I did get through was during the month long "security hold" that even they weren't allowed to make changes to solve the problem. Account is now completely barred from recovery for me, and the attacker is in full control.


The full version: So about a month and change ago and old email address I had a few things attached to including my MS account was compromised. This is its own story having to deal with how Bellsouth handled the legacy email addresses from when they bought up the baby Bells, shifted the addresses off to Yahoo, and then took them back. Result: Can't reliably change password even though I have access to the primary account the sub email address is attached to. This caused a serious issue when things got attacked on a weekend through it, including my MS account. (My fault for not switching the MS account off it, but I wasn't expecting the level of idiocy I've encountered with Microsoft's system making it a big deal. Literally ever other account compromised through the email address was easily secured.)


I go in to change the password for MS, all fine. At this point I had to disable the old email address through the main account outright, and have lost all access to that email address. Yet to my surprise, someone takes the MS account back! I go in and do the recovery form as I no longer have the original email (still waiting on AT&T to fix that whole mess), take it back myself and immediately enable two factor authentication. Much to my surprise, this locks the account down for a month! I then notice there is a strange recovery email address attached to the account, clearly the means the person took it back from me. But... I couldn't update the email addresses because of the lockdown!! So for the past month I've been juggling the account back and forth with the attacker. I eventually get ahold of someone at MS and they tell me they can do nothing "just recover the account again". So I do. And again. But lo and behold, I'm not the one in charge when the month ends despite my best efforts. So they apparently as soon as they could changed the phone number. In other words, my two factor authentication method which I had enabled not knowing it would lock me out for a month. And once two factor is on? YOU CAN'T DO ACCOUNT RECOVERY.


So here I am. No way to recover the account at this point. Locked out SOLELY because of Microsoft's insane "security" features (Seriously, you guys allow for a random email address to do the recovery? You lock out your own people from modifying the account even with verified identities. Are you kidding me with this ****?). I fortunately had no current credit cards on the account, but I can't simply make a new one. I have time left on expensive subscriptions on that account, I have 450,000 gamescore on the xbox gamertag for it, and god knows what in One Drive since they changed over how the user folders are stored. Not to mention should I ever need to boot up an old laptop that I don't have an individual PIN for, forget it, I'm screwed.


So. ... What now?

:)

 

Microsoft Account was hacked

Hi,

Thank you for posting your query in Microsoft Community.

I’m sorry to hear that someone hacked into your Microsoft account.

I understand how frustrating this could be. I will be glad to assist you with this.

I would suggest you to click on the link below for steps to recover your account.

http://windows.microsoft.com/en-us/windows/get-back-blocked-account

Sometimes, you may not receive any notifications if the two steps verification settings is turned off.

Please follow the instructions in the link below and make sure that the setting is turned on.

http://windows.microsoft.com/en-us/windows/two-step-verification-faq

Hope this helps. Do let us know if you need further assistance. We will be glad to help.

 

Microsoft Account was hacked

Original Title: Accessed my account

How cans someone hack into my Microsoft account when I have the two step verification .. that can only be approved from my cell phone?

 

Microsoft Account was hacked

Thank you but they did not change my password and I think I know who hacked into my account. My two step verification was not turned off. I even had to use the two step process a week or so before he hacked my account. He has top secret security clearance
and it seems is allowed to do anything. I just need to tell someone about this I guess.