Microsoft Account Hacked

Unfortunately my son learned the hard way not to hand over auth codes to a stranger in what felt like a friendly Discord server.

As far as I’ve been able to tell from Microsoft Support, the account is gone and we can’t get it back. Which sucks as it is. But it's more frustrating because his Minecraft account (and a license our family uses to play Minecraft) is tied to that account. Also gone. And without providing too much information to potential hackers out there, it was also used to log in to another gaming service that he's now lost a bunch of skins and achievements for. Not life or death stuff, but still frustrating to lose.

There’s a Microsoft account recovery tool, but even after we submitted various bits of verification options (past credit card details, old usernames, emails sent to from the account, Xbox Network ID it’s been on, etc.) they weren’t able to help us get anything back.

If anyone out there at Microsoft wants to help a distraught kid get his Minecraft account back, please reach out to me. But I know it's a tiny issue inside a mega corporation.

Order of Attack

As best as we can determine, here's how it happened:

• He's in one Discord server for Minecraft that's legit.
• He got an invite to a new Discord server for a Minecraft server he wanted to play on that someone recommended.
• After joining the new Discord server, they asked him to confirm his Minecraft account so they could add him to their Minecraft server.
• It was at this point they sent him a link to a fake login screen for Microsoft account security.
• The fake site triggered a secondary auth code to be sent for verification, which they asked him for, and unfortunately he gave to them.
• Then they were able to log in to his actual Outlook account.
• They changed his email address.
• Removed themselves from our Microsoft family.
• Removed the secondary auth security on the account.
• Added their own secondary auth security.

And now the account is theirs.

The email address they initially changed it to was n*****@outlook. But then I noticed it was redirected or set up to use a gmail account, a***@gmail.com, instead. (I'm hiding the actual email addresses so they can't search for it.)

Ugh. Frustrating. And a frustrating lesson to learn the hard way. But at least no critical information was tied to the account, no credit cards, or purchases were made. So it could've been worse. As far as hacks go, it's a fairly painless one. But he still feels frustrated, annoyed with himself, and sad at losing all the Minecraft gaming connections.