My Microsoft account was taken over, and I've lost access despite submitting account-recovery requests. The attacker replaced my former primary email address with a .ru address. Unfortunately, that account is also connected to an Azure tenant that still has my email and credit card attached. I can't sign in to remove the payment method or manage the tenant, so I'm looking for practical steps to stop any future billing and get the account closed or disconnected from my card.
3 Answers
Treat the Microsoft account compromise as a broader security issue, not just an Azure billing problem. Change passwords anywhere the same credentials were reused, enable multifactor authentication on remaining accounts, review recent card activity, and ask the card issuer about replacing the card if you cannot get the payment method removed. Also be careful about using an account tied to important personal data for testing in the future.
Your best option is to keep pursuing Microsoft support through the Azure billing and account-compromise channels. Explain clearly that you no longer have access, the account was taken over, and your payment card remains attached. Include billing records, the original account email, tenant details, and proof that you’re the cardholder. Ask specifically for billing cancellation or tenant closure rather than only password recovery.
If support remains unreachable and there are active or recurring charges, contact your card issuer and explain that the payment account is tied to a compromised Microsoft account. They may be able to block future recurring charges or replace the card. Keep records of every support attempt and provide them to the card issuer. In one similar case, the billing team eventually closed the account and refunded the charges after a payment dispute was opened.
There may not be any current balance to dispute, but I’ll ask the card issuer whether they can block future authorization attempts or replace the payment details.
That’s been the difficult part so far. I haven’t been able to get past the automated verification process, even after explaining that I can’t log in or reset the account.