Security info was deleted

The account is almost certainly compromised and the recovery email and security info have been changed by an attacker. Because of that, normal sign-in and verification will not work and the account must be recovered through Microsoft’s official processes.

Follow these steps in order:

1. Check for unusual sign-in and account activity (if still possible)
   If sign-in is still possible on any device or browser session where the account is already logged in, immediately go to the Security basics page and open Review activity to check the Recent activity page.
   • For any activity that is not recognized, in Unusual activity select This wasn’t me, or in Recent activity select Secure your account.
   • Then, from Security basics, select Change password and set a strong new password.
   If sign-in is no longer possible anywhere, continue with the next steps.
2. Use the hacked/compromised account recovery flow
   Because the security info and recovery email were changed, treat this as a hacked account and follow the official guidance in How to recover a hacked or compromised Microsoft account:
   • First, ensure the PC or device is clean (run a full antivirus scan such as Windows Defender).
   • Then attempt to reset the password.
   • If sign-in becomes possible again, immediately change your password and review connected accounts, forwarding, and automatic replies to remove anything the attacker configured.
3. If you cannot receive any verification codes
   When the attacker has replaced all security info and the password is not known or no longer works, use the Microsoft account recovery form as described in Troubleshoot Microsoft verification code issues:
   • Go through the steps under If you don't know your password and submit the recovery request via the account recovery form after reading Help with the Microsoft account recovery form.
   • Provide as much accurate information as possible (old passwords, devices, services used, etc.).
   • If the form is accepted and security info is replaced, be aware that the account may be restricted for up to 30 days before full access is restored.
4. If recovery ultimately fails
   If the recovery form is repeatedly rejected and the security info has been fully replaced by the attacker, there is no other supported method to regain access to that Microsoft account. In that case, follow the guidance from support articles and Q&A answers:
   • Use the hacked-account article for any remaining steps to protect other services and devices.
   • For services tied to the account (for example, Minecraft or Xbox), contact the specific product’s support to see whether they can help with licenses or entitlements once a new Microsoft account is created.
5. Protect other accounts and devices
   • Change passwords on the email account used as the Microsoft sign-in and on any other accounts where the same password was used.
   • Enable two-step verification / multi-factor authentication on important accounts.
   • Avoid entering account credentials on untrusted sites or forms (such as third-party “registration” forms on Discord servers) in the future.

References:

• What happens if there's an unusual sign-in to your account
• Notify us if you don't recognize activity on your account
• Troubleshoot Microsoft verification code issues
• How to recover a hacked or compromised Microsoft account