Short answer
Try Microsoft’s Sign-in helper first. If someone took over the account, scan your PC for malware before changing the password. Then use the account recovery form: give an email you can access that isn’t the account you’re recovering, and as much detail as possible — old passwords, contacts, exact email subject lines — from a device and place you normally use. Don’t resubmit; it slows the reply. A 25-digit recovery code, if you saved one, works at “Other ways to sign in”. If the account is locked for suspicious activity or a terms violation, that’s a separate reinstatement process.
Hacked, forgotten or locked?
- Hacked: the password changed, odd emails were sent, recovery details are different.
- Forgotten: you can’t sign in but nobody else has.
- Locked: the sign-in page says the account is locked or doesn’t let you continue — usually suspicious activity or a terms violation. That needs reinstatement, not the recovery form.
Before the form: secure the device
If the account was hacked, malware on your PC may have captured the password. Microsoft advises running a full scan before you change it — otherwise the new password can be stolen too.
Filling the recovery form well
- Provide a contact email you can access that is not the account you’re recovering.
- Use a device and location you normally sign in from — home or office.
- List old passwords you remember.
- For Outlook/Hotmail: give exact subject lines of recent emails and email addresses of contacts.
- Submit once. Microsoft replies by email; resubmitting slows things down. If it fails, you can try again with more detail.
Recovery codes and two-step verification
A 25-digit recovery code, if you created one, can be entered at “Other ways to sign in”. Lost codes can’t be retrieved. Microsoft says that if two-step verification is on and you can’t reach any alternate verification method, it cannot help — which is why saving a recovery code matters.
After you’re back in
- Change the password, review recovery email and phone, and remove unknown devices and app passwords.
- Check Outlook rules and forwarding — attackers add them to keep reading your mail.
- Every account that uses this email for resets (Instagram, Facebook, banks) is at risk: change those passwords too. See the 15-minute security checklist.
- Takeovers that lock you out of social accounts: our hacked account recovery service works through official channels.
Frequently asked questions
How long does the Microsoft recovery form take?
Microsoft reviews the answers and replies by email; its pages mention anything from about a day to several working days. Don’t resubmit while you wait.
Which email should I give on the form?
An email you can access that is not the account you’re trying to recover — Microsoft sends its reply there.
I have two-step verification and lost my phone. Can Microsoft help?
Only if you have another verification method or a recovery code. Microsoft says it can’t help if none of the alternate methods are available.
My account says it’s locked. Is that the same as hacked?
No. Locked accounts go through Microsoft’s reinstatement process; the recovery form is for sign-in and takeover problems.
Sources: Microsoft Support — recover a hacked or compromised Microsoft account, Microsoft Support — help with the account recovery form, Microsoft Support — guidance notes for the recovery form, Microsoft Support — Microsoft account recovery code, Microsoft Support — Microsoft account has been locked