Everywhere else has a way to establish my identity and restore access to far more sensitive and valuable information. I have no idea how they person accessing my account was able to change my information WITHOUT getting 2FA sent to me. MS just sends me a cheery email saying there was no evidence of account takeover and a link to the same account recovery process that doesn't work since I have 2FA enabled and then directs me to the process that requires a code be sent to the hacker. The 30 days are up.now what? I still can't reset my password without getting a recovery code from either the hacker's phone or email. No access to my MS Office account is a bigger deal, since I have papers to write, but I can do that with my account through the university where I teach. No access to my XBox account.OK, that sucks, but I can deal with it. They advise me to reset my security info and then dispute the charges.OK.that takes 30 days during which I can't access my account. They tell me that to dispute the charges, I need to log in, which of course I can't do. I call MS to report the fraudulent purchases and they waffle about, don't issue refund and seem generally uninterested in being helpful.

I call my CC company to report the fraud and they tell me that since I've used that same MS account in the past and the purchases are from there, they can do nothing aside from cancelling the card and I have to contact MS. Meanwhile whoever has my account has gone shopping for XBox Live gift cards. Then another account recovery form which has me wait 24h before they tell me that I don't have enough information after providing XBox device ID's, IP addresses, the last 4 digits of my CC number and so on.

They direct me to a form that only works IF you don't use 2FA. Once I get to work, I try to log in and then to reset the password, which of course I can't do because I don't have access to this other email and phone number, only the ones that have been removed by the intruder. Shortly after that, I get another notice that the password has been changed. followed moments later by a notification that my alternate email has been removed and replaced with a Gmail account that I don't recognize. Last month, on my way to work, I get a notification from Microsoft that someone has changed the phone number associated with my account. This is a great idea when it's implemented the way my bank, credit card or anyone else does it. Wanting to protect my account, I set up 2FA as advised by Microsoft. I do not use my account for email though. I used it for XBox and Office, both of which I use regularly. I have had the same MS account for over 10 years.

TL DR My MS account was accessed and information reset by someone else and used to lock me out thanks to 2FA.

25 digit recovery code microsoft