My 25+ years Microsoft account got hacked by someone with bibimail, and I can't recover it

Same thing just happened to me. details of hacker - email address removed for privacy reasons.

I sent email to support and got a reply saying the case was closed unsuccessful as they tried to contact me but I did not answer. Received no calls / mails and not even notification that case was closed. Only knew that bit as I messaged them for an update.

Support sends you to an AI chat that does nothing, and at the end send you back to support. Stuck in an endless loop.

No way of contacting a live person for help either.

How can a multi billion dollar company have such low customer support.

Any help on what to do would be very welcome.

I have a similar problem , so here is what i did , waiting to response my microsoft team : 

Step 0 — Clean your devices FIRST (non-negotiable)

Microsoft's own guidance: run a full antivirus scan before changing any passwords — if an infostealer is still on your PC, the attacker will just steal the new password and re-take the account. Use Windows Defender full scan + a second opinion (e.g., Malwarebytes free scan). Also check your browsers for suspicious extensions and clear saved cookies.

Step 1 — Try the sign-in helper

Go to Microsoft's "How to recover a hacked or compromised Microsoft account" page and use the sign-in helper tool — it routes you to self-help or an agent depending on your situation.

Step 2 — The Account Recovery Form (your main weapon): account.live.com/acsr

Since your alias was removed, this automated form is your primary path. Critical tactics:

Use your ORIGINAL email address as the account identifier, plus a working contact email you control.

Fill it out from a device and location you previously used to sign in — this significantly raises your success odds.

Accuracy beats quantity — wrong guesses hurt more than blanks.

Provide: old passwords (even years-old ones — check browser saved passwords), exact email subject lines (search your other mailboxes for messages you sent from that account), frequent contacts, Skype ID, and especially purchase proof: order numbers, billing name/address, last 4 digits of the card used.

Xbox users: include the console's hardware/Device ID — that field carries heavy weight.

You can submit 2 times per 24 hours; if rejected, improve the data before resubmitting rather than repeating the same answers.

⚠️ If the attacker enabled 2FA on the account, the form may tell you the request will be ignored — that's the hardest scenario.

Step 3 — Escalate to a human via live chat

Go to support.microsoft.com/home/contact, type "MSA", sign in with any other working Microsoft account (create a temporary new one if needed), choose Microsoft 365 and Office → Manage account security → Chat with Support Agent in Web Browser. Ask the agent to suspend/freeze the compromised account to stop the attacker using it (victims have succeeded in getting hijacked accounts suspended this way), and give them your ACSR case number, purchase receipts, and Xbox device IDs. Be honest with yourself about the limit here: support agents cannot manually reset consumer accounts — but they can suspend, and occasionally escalate strong proof-of-ownership cases.

Step 4 — Report the attacker infrastructure

Report the abuse to the registrar: email address removed for privacy reasons (from your WHOIS lookup) — disposable domains used for account takeover can be flagged. (Note :  i dont think it will work.)

Report to Microsoft: https://msrc.microsoft.com/report/abuse and to your local cybercrime authority (e.g., IC3.gov in the US, Action Fraud in the UK).

Part 3 — Protect the Blast Radius (do today)

The attacker will try your Microsoft credentials elsewhere and can reset passwords on anything tied to that inbox:

Change passwords on every account that used the same or a similar password — email, banking, Discord, EA, social media. Use a password manager and unique passwords.

Check the mailbox that received Microsoft's security alerts (the Gmail/etc. that got the "your security info was changed" notification) — Microsoft sometimes includes undo links valid for a limited window. Search it now for any "Remove this alias" or "this wasn't me" links. This is occasionally an instant-recovery path if caught early.

Freeze/notify your bank if cards were stored in the Microsoft account.

If you regain access, immediately: remove the bibimail alias, change password, enable Microsoft Authenticator + a hardware key or passkey, generate and save the 25-digit recovery code offline, review sign-in activity, and purge any malicious Outlook rules/forwarding the attacker set up.

My email of 20 years was also hacked by some bibimail domain on the same day. And the account recovery process has been useless so far. None of my emails get replied. All the support tickets i opened said they could not give me a timeline. I tried to get an actual person to reply me but no luck so far. 

Have you gotten your email back? 

Same problem here. In a split second, I received two emails notifying me that changes were being made to my account, including a password change. From that moment, I was locked out of my account.

What is honestly unbelievable is what happened afterwards. I have tried every recovery method Microsoft provides, but getting any actual human support seems impossible. No matter how much evidence you have that the account belongs to you or that it has been compromised, you are simply redirected to automated support forms that lead nowhere.

They ask for information or access to recovery methods that you no longer have precisely because the attacker changed them. And if the automated system doesn't accept your answers, that's it. There doesn't seem to be any way to explain the situation to a real person who can actually look at the case and the evidence.

How is it possible that someone can make multiple security changes to an account in a matter of seconds, but when the actual owner tries to recover it afterwards, Microsoft treats them as if they are the suspicious party?

I completely understand the need for strong security measures, but there needs to be some kind of escalation process for cases like this. Having no way whatsoever to speak to a human when your account has clearly been compromised is incredibly frustrating.

I have been using this account for years and have important information and accounts connected to it. I don't want to lose everything simply because the automated recovery system cannot verify something that a real support agent could potentially resolve.

I don't even want anything complicated. I just want the opportunity to speak to an actual person, provide whatever evidence is necessary, and have someone properly investigate what happened.

My account was hacked in a very similar way, and the same @bibimail.net address was added to my account as security information. I managed to get my account suspended so the hacker couldn’t use it, but I haven’t been able to recover it because the account was pre-owned.

However, I followed a detailed recovery process that helped me get the account suspended. I can share the website with you — it explains the recovery process step by step. Since your account was originally yours, you may have a much better chance of recovering it than I did.

If you’re comfortable with it, please contact me on Discord: dravix34. If you don’t use Discord, you can give me an email address where I can contact you, and I’ll send you the website there.

Dobrý den, mám stejný problém s účtem syna. Prosím, dostal jste od Microsoftu odpověď? Jak to vyřešili? Přeci musí vědět, že ty e-maily jsou napadeny? Děkuji.