Account suspended after being hacked — Microsoft refusing recovery due to hacker-enabled TSV

Microsoft personal account recovery is strictly controlled and support agents cannot bypass security mechanisms such as two-step verification (TSV), even when it was enabled by an attacker. When security info is removed and replaced, and TSV is enabled by the attacker, recovery is only possible through the official automated and escalation flows.

Based on the available guidance, the practical options are:

1. Use the hacked/compromised account recovery flow

• Follow the official guidance for compromised accounts: How to recover a hacked or compromised Microsoft account.
• Start with the sign-in helper tool, which will route to self-help or an agent depending on what is possible for that account.
• If sign-in is not possible because of TSV and removed security info, proceed to the account recovery form when prompted.

2. Complete the account recovery form as thoroughly as possible

• Use the account recovery form referenced in the compromised-account article (the form is the primary method Microsoft uses to verify ownership when normal sign-in and security info are unavailable).
• Provide as much accurate historical information as possible (old passwords, subject lines of emails, contacts, billing details, etc.).
• If the form is rejected multiple times, the account is treated as non-verifiable and cannot be recovered; support and moderators cannot override this.

3. If the account is suspended/locked, use the reinstatement/unlock path

• If the account was locked or suspended due to suspicious activity or violation of the Microsoft Services Agreement, follow the on-screen link that begins with aka.ms/ when attempting to sign in. This opens the account reinstatement form.
• Submit the required information once and wait for the Microsoft Online Safety team to review it. Submitting multiple forms can slow the response.
• For OneDrive-specific blocking ("Your account is currently unavailable"), use the Microsoft services account reset page to check status and attempt reactivation.

4. Understand support and moderator limits

• For locked or suspended Microsoft accounts, support agents and moderators are limited to what the automated systems allow. They cannot:
  • Disable TSV that is currently enforced on the account.
  • Manually restore removed security info.
  • Grant access to OneDrive or Outlook data without successful verification via the recovery systems.
• Moderators on public forums (including Microsoft Q&A and Answers) cannot access or modify personal accounts and can only direct to the same official recovery and support channels.

5. Contact support again only through official channels

• If the recovery form and reinstatement form have already been used and the case was closed citing TSV, the only escalation path is still via official support:
  • Use the sign-in helper in the hacked-account article and follow any offered path to speak with an agent.
  • From there, ensure the existing case ID is referenced, but be aware that if the system flags the account as non-verifiable due to TSV and missing security info, agents may not be able to change the outcome.

6. OneDrive data retention

• For OneDrive accounts that are blocked due to suspicious activity or Microsoft Services Agreement violations, the block may be temporary in some scenarios, but if the account remains unrecoverable, data can eventually be deleted according to Microsoft’s retention policies.
• There is no documented mechanism in the provided guidance for retrieving OneDrive content if ownership of the Microsoft account cannot be re-established through the official recovery processes.

In summary, the only supported options are:

• Use the hacked-account recovery flow and account recovery form.
• Use the account reinstatement form (aka.ms link) for locked/suspended accounts.
• Use the Microsoft services account reset page for OneDrive-specific blocking.
• Work with official support via those channels; moderators and agents cannot bypass TSV or manual verification requirements.

References:

• How to recover a hacked or compromised Microsoft account
• Microsoft account has been locked
• Reactivate an account that has been blocked
• My account got hacked. - Microsoft Q&A
• How do I send an email to Microsoft about my account being hacked and taken over by <removed> ? - Microsoft Q&A
• Need help with hacked microsoft account - Microsoft Q&A
• I can't sign in to my Microsoft account
• IVR_ContactSupport_T2