How to Close a Hotmail Account That Has Been Hacked: Immediate Security Steps to Lock Out Unauthorized Access

If your Hotmail account has been hacked, learning how to close it quickly is just the start—you’ll also need to lock down the damage before the hacker strikes again. ✨ I learned this the hard way when helping a friend recover from a targeted phishing attack that turned their email into a spam relay.

The first 30 minutes after discovering the breach are critical, and Microsoft’s tools make it possible to lock things down without losing control completely.

You’ll need access to a trusted device where you can verify your identity—Microsoft requires two forms of verification before permanent closure. Start with a password reset using their Security Checkup tool, then enable two-factor authentication through an app like Authy or Microsoft’s own Authenticator.

If the account’s locked, Microsoft’s account recovery portal (linked below) walks you through alternative verification methods, like answering security questions or confirming recent activity.

Once verified, the closure process takes under 10 minutes if you follow Microsoft’s official deletion steps. You’ll receive a confirmation email, but here’s the kicker: monitor your email for 30 days—hackers often reappear after deletion to exploit saved credentials elsewhere.

Use a tool like Have I Been Pwned to check if your password was leaked, then change it on every other account tied to that email.

The real cleanup starts after deletion. Report the hack to Microsoft’s Security Response Center, and if financial or personal data was exposed, file reports with the FTC’s IdentityTheft.gov. Trust me, I’ve seen hackers pivot to other accounts within hours—don’t leave them an open door.

What you need

Step-by-step instructions for securing and closing a compromised Hotmail account

Here’s how I handle a hacked account—locking it down permanently while minimizing data loss.

Start by visiting Microsoft’s account recovery page at account.microsoft.com/security. Sign in using any verified recovery method—even if it’s compromised, this triggers a temporary lock. If you can’t sign in, use the “Forgot password?” option and select “I don’t have any of these.”

Microsoft will send a one-time security code to your trusted phone number or alternate email. If those are compromised, request a security code via text instead of email. Once you receive it, enter it immediately—this creates a temporary block on the account while you proceed.

Here’s the thing—if the hacker has already changed your recovery info, Microsoft may require government-issued ID for full access. Have your driver’s license or passport ready in case verification is needed.

After securing temporary access, go to account.microsoft.com/password and change the password to a 20+ character random string (use a password manager like Bitwarden or 1Password to generate one). Avoid reusing old passwords—this is critical.

Next, navigate to account.live.com/consent/Manage and select “Sign-in and security.” Under “Where you’re signed in,” you’ll see all active sessions. Click “Sign out all other sessions”—this forces the hacker offline immediately. If you don’t see any sessions, the hacker may have already cleared them.

I always enable two-step verification (2SV) at this point, even if it’s just authenticator app codes. Text-based 2SV is better than nothing, but an app like Microsoft Authenticator is far more secure.

In the same Sign-in and security menu, scroll to “Advanced security options” and select “View active devices.” Here, you’ll see all devices linked to your account. Revoke any unknown devices—especially if they’re listed as “Windows Phone” or “Android” with unfamiliar names.

Under “Apps with access to your account,” revoke permissions for any suspicious apps—especially email clients (Outlook, Thunderbird), social media, or cloud storage. Some apps (like LinkedIn) may require re-authentication later, but that’s better than leaving backdoors open.

Real talk: Hackers often install keyloggers or remote access tools under fake app names. If you see anything labeled “Tech Support“ or “Windows Update Helper,” revoke it immediately.

Once you’ve secured the account, visit account.microsoft.com/closeaccount to initiate closure. Microsoft will ask you to verify identity one last time—use the password you set earlier and any remaining recovery methods. If you’ve already lost access to all recovery options, you’ll need to contact Microsoft Support with your government ID to prove ownership.

During closure, Microsoft will ask if you want to download a copy of your data (emails, contacts, etc.). If the account was heavily compromised, do not download emails—they may contain malware. Instead, select “No, I don’t want a copy” and proceed.

This step is the moment that matters: Confirm the closure request. You’ll receive a final email (to any remaining verified addresses) confirming the account is permanently deleted within 60 days. If you need it deleted faster, Microsoft’s fraud team can expedite the process with proof of hacking.

After closure, check your credit reports (via AnnualCreditReport.com) for any suspicious activity tied to your email. Hackers often use stolen accounts to open loans or credit cards. Also, set up fraud alerts with the FTC at IdentityTheft.gov.

If you used this Hotmail for other Microsoft services (Xbox, Office 365), those accounts may still be linked. Go to account.microsoft.com/devices and revoke all sessions again. For Xbox Live, visit account.xbox.com/security to ensure no gaming accounts are compromised.

Finally, set up email forwarding from any remaining addresses to a new, secure email provider (like ProtonMail or Google Workspace). This ensures you don’t miss critical notifications during the transition.

Tips & tricks for securing and closing a hacked Hotmail account

Here’s what I’ve learned from helping clients recover from account breaches—these tricks will help you lock down your account faster and more securely.

Recovery Code Strategy: When requesting a security code in Step 1, prioritize text messages over email—hackers often monitor compromised email accounts. If you don’t receive the code, check your spam folder immediately, but don’t rely on it. Having a backup phone number registered with Microsoft (even if unused) can be a game-changer when all else fails.

Password Generation: For the 20+ character random string in Step 2, I recommend using a password manager to generate something like “7x#pL9@qR2!mK8$vP5%hT1” instead of trying to memorize it. Write it down on paper (not digitally) and store it in a secure place—you’ll need it for verification later. Avoid common substitutions like “p@ssw0rd” that hackers can easily crack.

Device Investigation: In Step 3, treat any unknown device with suspicion—especially if it’s labeled as a “Windows Phone” or “Android” with a generic name like “Unknown Device.” Some hackers register these devices to maintain access. If you see anything suspicious, revoke it immediately, then check your bank statements later for any unauthorized transactions.

Data Download Warning: During Step 4’s closure process, declining to download emails is often the safest choice. Hackers frequently inject malware into email attachments or even the email client itself. If you must recover data, use a clean, offline computer with updated antivirus software—never download emails directly to your primary machine.

Frequently asked questions

Got questions about closing your hacked Hotmail account? We’ve got answers! Here are some of the most common concerns—and how to tackle them—so you can regain control of your security without stress.

Wrapping up and next steps

Closing a hacked Hotmail account is a critical step to protect your privacy and security—but you’re not alone! By following the steps above, you’ve taken control and minimized risks. Remember: Always enable two-factor authentication (2FA) on any remaining accounts to stay ahead of potential threats.

Now that your account is secure, take the next step: update your passwords across all platforms and monitor for suspicious activity. Your digital safety is worth the effort—you’ve got this! 💪