Suspicious Call About Your Microsoft Account? What to Do Next

“A caller says your Microsoft account is compromised” can be alarming, especially if they know your name. Microsoft does not make unsolicited support calls. Hang up, then check your account at an address you type yourself.

Quick Diagnosis

Fix #1: End the Call and Check Microsoft Independently

Symptoms: Someone calls claiming to be Microsoft support. An email, text, or pop-up may also give you a number to call about an account or computer problem.

Why it happens: Scammers can sound professional and may know your name or email address. A familiar detail or caller ID doesn’t prove who is calling. Microsoft says it doesn’t make unsolicited support calls or ask for personal or financial information through unsolicited contact.

• Hang up. Don’t share a verification code or password, pay, or allow computer access.
• Ignore the number and links in the call, message, or pop-up. Type account.microsoft.com into your browser’s address bar.
• Sign in and open Security to check your account. Check any possible security alert there instead of replying to the message.

Microsoft’s public security-information guidance — public documentation captured October 16, 2026. This is a documentation view, not a signed-in account or a performed device procedure.

Verify: If you shared nothing and see no activity you don’t recognize, you don’t need to follow the caller’s instructions. Use Fix #3 to check sign-ins more closely.

Treat a warning pop-up with a support number the same way. Microsoft says genuine error and warning messages don’t include a phone number to call. Close the browser or restart the computer if the pop-up won’t close.

Common Issues and Solutions

Choose the fix that matches what you already shared. If you shared more than one thing, follow each relevant fix.

Fix #2: Secure Your Account After Sharing a Code or Password

Symptoms: You read a six-digit verification code to the caller, gave them your password, or approved a sign-in request they prompted.

Why it happens: A code can let someone complete a sign-in or change your security settings. Treat it as exposed even if the caller said it was only to “confirm your identity.”

• End the call and stop replying to follow-up messages.
• If the caller accessed your computer or asked you to install software, use another device you trust for these account steps. If you need to use the affected Windows PC, complete the full scan in Fix #5 before changing your password on it. Microsoft documents that order in its compromised-account guidance. Then type account.microsoft.com into a trusted browser and sign in.
• Open Security and change your password. If you used that password elsewhere, change it there too.

• Check the authentication and recovery methods under Security > Manage how I sign in. Remove a method you know an attacker controls. If you need to replace your security information, add a working method you control before removing the old one. Requesting removal of all security information puts the account into a restricted state for 30 days. The account remains active, but the information does not change immediately and further changes or additions to security settings and billing information are restricted during that period.
• In Advanced security options, use Sign out everywhere if you suspect unauthorized access. Microsoft says sign-out can take up to 24 hours and excludes Xbox consoles.
• Check Recent activity using Fix #3. Respond to entries you can’t explain. If Outlook was affected, check connected accounts, forwarding and automatic replies for changes you didn’t make.

Verify: Your new password works, your recovery information is yours, and you recognize the activity shown. If you can’t sign in, go to Fix #4 promptly.

Fix #3: Inspect Recent Activity for Unfamiliar Sign-ins

Symptoms: The caller claims someone accessed your account, or you want to know if a shared code was used.

Why it happens: A caller’s claim doesn’t prove account access. Microsoft’s Recent activity page shows account use from the past 30 days.

• Type account.microsoft.com into your browser, sign in, and open Security. Choose Review activity to open Recent activity.

Microsoft’s public Recent activity explanation — public documentation captured October 16, 2026. This is a documentation view, not a signed-in account or a performed device procedure.

• Expand entries you don’t recognize. Compare the time, device, browser, and access details with what you were doing. A location may be approximate.
• For an entry under Unusual activity that wasn’t yours, select This wasn’t me and follow Microsoft’s prompts. For a suspicious entry elsewhere, use Secure your account where Microsoft offers it.
• Return to Security and check your password and security information if you find activity you can’t explain.

Verify: You’ve reviewed unfamiliar entries and completed the response Microsoft showed. This wasn’t me appears only for entries in Unusual activity.

Fix #4: Start Account Recovery If You Cannot Sign In

Symptoms: Your password no longer works, or you can’t complete the account’s verification steps after speaking with the caller.

Why it happens: Your account may need recovery. A failed sign-in alone doesn’t prove what the caller did.

• Open Microsoft’s account recovery form guidance yourself. Try the Sign-in Helper linked there first. If the guidance directs you to the recovery form, prepare a working email address for the reply and information about how you used the account.
• Use verification methods you control. If two-step verification is on and you cannot access any alternate verification method, Microsoft says the recovery form and support cannot bypass that protection. Support agents cannot send password-reset links or access and change account details. Don’t give codes, passwords, or screenshots of sign-in challenges to anyone who contacts you.
• If you regain access, change your password and complete Fixes #2 and #3.

Verify: You can sign in from a browser you trust and recognize the account’s security information.

Fix #5: Remove Unwanted Software and Review Device Recovery

Symptoms: You installed software at the caller’s request, shared your screen, or allowed remote control.

Why it happens: The caller may have seen files, changed settings, or left remote access software installed. Microsoft advises removing software installed for the caller, scanning a Windows PC, and considering a reset after device access.

• Stop following the caller’s instructions. If they still control the computer, use another device you trust to reach official Microsoft Support; Microsoft’s consumer scam guidance lists its support options for urgent situations.
• On another device you trust, change passwords for accounts you used or opened during that session. Include your Microsoft account.
• Uninstall the remote access app the caller asked you to install. In Windows, open Settings > Apps > Installed apps. Windows 10 may show Apps & features instead.

• On Windows, open Start > Windows Security > Virus & threat protection > Scan options. Choose Full scan, then select Scan now. Microsoft’s compromised-account guidance says to run the full scan before changing your password on the affected PC.

Microsoft’s Windows malware-scan and compromised-account guidance — public documentation captured October 16, 2026. This is a documentation view, not a signed-in account or a performed device procedure.

• Consider resetting the Windows PC if you gave the caller device access; Microsoft recommends considering this after access was granted, without requiring malware to return first. Read Microsoft’s Windows recovery options before choosing a method: some options can cause data loss. Back up important personal files to an external SSD or USB drive you trust.

Verify: Complete the scan and the recovery steps you selected, then check your account activity again. Finishing a scan is not a reason to skip Microsoft’s advice to consider a reset after device access. If unwanted control continues or you cannot remove software, use official support for further help.

Fix #6: Contact Your Payment Provider If You Paid

Symptoms: You paid the caller or entered card details into a page they supplied.

Why it happens: The payment or card details may have gone to a scammer.

• Contact your bank or card provider using the number on your card or its official app.
• Say you paid a caller posing as Microsoft support. Ask about disputing the charge and replacing your card.
• Check recent transactions and report any you don’t recognize.

Verify: Your payment provider has recorded the report and told you what to watch for. If you also shared a password or allowed computer access, complete those fixes too.

Fix #7: Report the Impersonation to Microsoft

Symptoms: You received an unsolicited call, email, text, or pop-up claiming to be Microsoft support, even if you shared nothing.

Why it happens: Reporting gives Microsoft details of the scam attempt. Microsoft’s official consumer guidance directs readers to www.microsoft.com/reportascam. The Microsoft Report Fraud site is also an official Microsoft destination.

• Type www.microsoft.com/reportascam into your browser, using the entry point Microsoft names in its guidance.
• Follow the reporting instructions shown. Keep details of how they contacted you and what they requested. Don’t include a password or verification code.

Microsoft’s tech-support-scam recovery and reporting guidance — public documentation captured October 16, 2026. This is a documentation view, not a signed-in account or a performed device procedure.

• Keep call details, messages, or payment records you may need for your bank or a later support request.

Verify: Follow the confirmation or next steps the reporting service shows. Keep your call, message and payment records. Also change any exposed password, check account activity, or contact your payment provider as needed. Microsoft’s guidance also recommends considering local law enforcement.

Error Messages and Alerts

What you see or hear	What it means	What to do
A caller says your Microsoft account is “compromised”	The claim is unverified	Hang up and check Security at account.microsoft.com
A message gives a “Microsoft support” callback number	The number doesn’t prove who sent it	Don’t call it; open Microsoft’s site yourself
An unexpected six-digit verification code arrives	Someone may be trying to sign in or make a change	Don’t share it; check Recent activity
Unusual activity appears in Recent activity	Microsoft flagged an entry for review	Expand it and use This wasn’t me if it wasn’t yours
This wasn’t me is missing from an entry	That option doesn’t appear on every entry	Use Secure your account where offered, and check Security

Platform-Specific Checks

You can check your Microsoft account and report the scam in a desktop browser. Device checks depend on the computer the caller accessed.

Windows

If the caller controlled your PC, follow Microsoft’s consumer recovery steps in Fix #5: remove the software they requested, run the Windows Security full scan, apply security updates, and consider resetting the device after access was granted. Use another trusted device for urgent support if unwanted control continues.

macOS

The Microsoft account checks above work in a browser on a Mac. The Windows Security scan in Fix #5 is for Windows, not macOS. If the caller installed software or still controls your Mac, use another trusted device to reach official support for help removing the unwanted access. Check your Microsoft account’s Security and Recent activity pages in a browser you trust.

Web

Type account.microsoft.com into your browser’s address bar. Open Security > Review activity to check a possible alert in Recent activity. You don’t need the alert’s link or the caller’s number.

Settings to Check

After sharing a code or password, check these items in your Microsoft account’s Security area:

• Password: Set a new, unique password. A password manager can help you keep track of it.
• Security information: Confirm that the authentication and recovery methods belong to you. When replacing security information, add a working method you control first; don’t remove every method at once.
• Sessions: Review sign-ins and use Sign out everywhere when appropriate, allowing up to 24 hours and handling Xbox consoles separately.
• Outlook: If that mailbox was affected, check connected accounts, forwarding and automatic replies.

After checking the existing methods, review or add a trusted sign-in method such as Microsoft Authenticator or a passkey through Manage how I sign in. Never read a code to an unexpected caller.

Getting Help

If you can’t recover the account, type support.microsoft.com into your browser for Microsoft’s official support site. If the caller accessed a work or school account, tell your IT administrator. They can check sign-in records and account access. If you paid, contact your bank or card provider first.

Microsoft’s consumer scam, account recovery, security-information, Recent activity and Windows recovery guidance were reviewed October 16, 2026. The images are captures of public documentation from that date; no signed-in account, reporting-form submission or device-recovery procedure was performed for this article.

Prevention Tips

• End an unexpected call that asks for a code, password, payment, or remote access.
• Check possible Microsoft alerts by opening account.microsoft.com yourself.
• Use a unique password for each account. Then an exposed Microsoft password won’t open another account.
• Tell family members who share your computer that a polished voice or personal details don’t prove someone works in support.

Wrapping Up

Fix #1 is usually enough if you shared nothing: end the call and check Microsoft’s site yourself. If you gave out a code or password, secure your account and check Recent activity right away. Get further help if unknown sign-ins or malware keep appearing.