Lock it down, in order
Work top to bottom. Each step makes the next one count for more.
Ticks stay on this page only and clear when you leave.
Already been taken over?
- Use the Sign-in helper Microsoft's hacked-account page starts with its sign-in helper tool, which asks for your email or phone number and points you to self-help or an agent.
- Scan your PC before changing anything Run a full scan. In Windows Security, open Virus and threat protection and select Scan options > Full scan > Scan now.
- Change or reset your password Sign in and change your password. If you can't sign in, reset it.
- Check the settings Microsoft resets Microsoft says it resets some settings after a compromise. Check connected accounts, forwarding and automatic replies in Outlook.
- Use the account recovery form if needed If you cannot reset the password, fill in the recovery form at account.live.com/acsr using a working email address. Microsoft reviews answers and responds within 24 hours.
- Re-secure and review purchases Add fresh security info, turn two-step verification back on and look for unexpected charges or subscriptions.
Red flags to watch for
- Someone offers to 'reset' your Microsoft account for you. Microsoft says its support agents are not allowed to send password reset links or change account details.
- A message asks you to read out a security code Microsoft sent to your phone or email.
- A sign-in page that is not on a Microsoft domain asks for your Xbox or Outlook password.
- Unexpected changes to Outlook forwarding or automatic replies.
- Purchases you don't recognise on your Microsoft account.
One Microsoft account protects your Xbox, email and Store
Your Xbox gamertag is attached to a Microsoft account, the same kind of account used for Outlook.com, Windows sign-in and Microsoft Store. When we talk about securing "your Xbox account", we really mean securing that Microsoft account, plus a few settings on the console itself.
All the important controls are on the Security tab at account.microsoft.com/security. Select Manage how I sign in and you will see the ways Microsoft can confirm it is you. You can add up to 10 of them: email addresses (they don't have to be yours, so a trusted family member's address can work as a backup), an authenticator app, or a passkey.
Microsoft has also said it is phasing out SMS as a way to authenticate and recover personal Microsoft accounts, and you may find the option to add a new phone number is not offered. That makes an authenticator app, a passkey and a backup email more important than they used to be.
Two-step verification without locking yourself out
Two-step verification means signing in needs your password plus a second proof, such as a code from your authenticator app or email. To turn it on, go to the Security tab, select Manage how I sign in, and under Additional security and Two-step verification choose Turn on.
Read Microsoft's warning before you do. With two-step verification on, you always need two forms of identification. If you forget your password you need two contact methods, and if you lose your contact method your password alone won't get you back in. Microsoft says it can take 30 days to regain access and you may even lose the account, so it strongly recommends having three pieces of security info on the account.
A sensible set-up for most players is: the Microsoft Authenticator app (or another authenticator), a passkey on your phone or PC, and a backup email address you control. Write down where each one lives. Some older apps and devices, which Microsoft gives the Xbox 360 as an example of, cannot use security codes and need an app password instead; Microsoft explains this in its two-step verification help.
Our view: set up your backup methods first and turn on two-step verification second. It is much easier than trying to add them after you have been locked out.
Microsoft account passkeys versus the Xbox console passkey
The word "passkey" turns up in two different places, which confuses a lot of people.
A Microsoft account passkey replaces your password with your face, fingerprint or device PIN. To create one, sign in to Advanced Security Options at account.live.com/proofs/manage, choose Add a new way to sign in or verify, select Face, Fingerprint, PIN, or Security Key and follow your device's prompts. You can save it to a password manager, to a phone or tablet, to a physical security key, or to Windows Hello on your PC. Microsoft describes passkeys as phish-resistant: they can't be guessed or typed into a fake site.
The Xbox console setting lives under System > Settings > Account > Sign-in, security & passkey. Its job here is mainly to stop other people in your home buying things on your account. Microsoft's steps are: select Change my sign-in & security preferences, scroll right and select Customize, select Ask for my passkey to make purchases, then choose Passkey required. Follow the on-screen prompts on your console, and treat this as a household purchase lock rather than a replacement for two-step verification.
Stopping surprise purchases on Xbox and Windows
Microsoft's own advice on preventing unauthorised purchases is aimed as much at accidents as at thieves: a child tapping "buy", or someone sharing your console. On Xbox, the Ask for my passkey to make purchases setting described above is the main control.
On a Windows 10 PC, open Microsoft Store settings and, under Purchase sign-in, turn off "I want to buy without a password, for faster checkout". Repeat this on every device you share. If you let a child use your payment method on their own account, Microsoft also offers adult approval for the things a child wants to buy in Microsoft Store on Windows and Xbox; our parents' page explains where that fits with wider family settings.
If you spot a charge you don't recognise, check whether it is a subscription renewal before assuming theft, then follow Microsoft's guidance on unexpected charges and, if needed, its compromised-account steps below.
Microsoft's recovery route if your account is taken
Microsoft's hacked-account article sets out three steps. First, clear your PC of malware before you change the password: in Windows Security open Virus and threat protection and choose Scan options > Full scan > Scan now. Second, sign in and change your password, or reset it if you can't sign in. Third, check your settings, because Microsoft resets some of them after a compromise; look at connected accounts, forwarding and automatic replies.
If you cannot reset the password, Microsoft suggests trying the Sign-in helper tool first, then the account recovery form at account.live.com/acsr. You will need a working email address for Microsoft to reply to (a friend's or a new free Outlook.com address is fine). The form asks questions only the owner should know, such as old passwords, email subject lines and contacts. For Xbox players, it may ask for the hardware ID of a console you use a lot. Microsoft says guessing is fine because wrong answers don't count against you, and it responds within 24 hours.
One hard limit: Microsoft says that if you had two-step verification on and can't access any of your other verification methods, it cannot help, and its agents can't send reset links or change account details. That is another reason to keep three methods current. If you are working through this now, our hacked? start here page keeps the order straight, and our guide to fake support agents covers people who pretend they can shortcut the process.
Questions
Can a Microsoft support agent reset my password for me?
No. Microsoft says its support agents are not allowed to send password reset links, or access and change account details. Anyone offering to do this is not genuine support.
How long does the Microsoft account recovery form take?
Microsoft says it reviews your answers and responds within 24 hours, using the working email address you give at the start of the form.
Is the Xbox 'passkey' the same as a Microsoft account passkey?
They are separate settings. The account passkey is created at account.live.com/proofs/manage and uses your face, fingerprint, PIN or a security key. The console setting under Sign-in, security & passkey is mainly used to control sign-in and purchases on that Xbox.
What if I lose my phone with two-step verification turned on?
You will need another method on the account, such as a backup email or passkey. Microsoft warns it can take 30 days to regain access otherwise, which is why it recommends three pieces of security info.
Sources we checked
- Microsoft Support: How to use two-step verification with your Microsoft account
- Microsoft Support: Microsoft account security info & verification codes
- Microsoft Support: Create and save a passkey
- Microsoft Support: How to recover a hacked or compromised Microsoft account
- Microsoft Support: Help with the Microsoft account recovery form
- Microsoft Support: Prevent unauthorized purchases from Microsoft Store