Xbox account hacked: how to recover it and lock it down

A hacked Xbox account usually shows up in small ways first. A purchase you did not make. A friend asking why you sent a strange message. A sign-in alert from a place you have never been. This guide follows the order in Microsoft and Xbox's own help pages, with the FTC's advice added where it fits.

Signs your Xbox account may be compromised

Your Xbox profile signs in through a Microsoft account. So the signs can show up in either place. Common ones include:

• A password that suddenly stops working.
• Security emails about a change you did not make.
• Charges in your billing history that you do not recognize.
• Sign-in activity from a device or location that looks unfamiliar.
• Messages or friend requests sent from your profile that you did not send.

Xbox Support notes that the location shown for sign-ins is based on IP address and is approximate. It suggests you look for consistency rather than exactness. A city that is a bit off is not proof of a hack. A sign-in you cannot explain at all is worth acting on.

Step one: use Microsoft's recovery tools

According to Xbox Support, if you think your Microsoft account has been hacked, you should reset your password right away. It recommends choosing a password you do not use anywhere else.

Both Xbox Support and Microsoft point to the Sign-in Helper. Per Microsoft, the tool asks for your email address or phone number. It then shows self-help steps or offers the chance to talk to an agent.

If you cannot sign in because you cannot remember the password or think it was changed, Xbox Support sends you to Microsoft's password reset page. If you cannot reset your password, it says you must use the Microsoft account recovery webform.

One order-of-operations point comes from Microsoft's page on recovering a hacked account. It says to make sure your antivirus program is running and up to date, then run a full scan before you change your password. After the scan, sign in and change the password to a strong one. If you cannot sign in, reset it.

The FTC gives the same basic advice. Its guide says to make sure your computer security software is up to date and run a scan, then follow the provider's recovery instructions.

Step two: check activity, account info, and billing

Once you are back in, Xbox Support lays out a sequence.

Review recent activity. In the Security section, you can open the sign-in activity list and select View my activity. Microsoft will ask you to confirm your identity with a security code first. If you see a successful sign-in you do not recognize, Xbox Support says to select "This wasn't me" and to change your password right away if you have not already.

Review your account info. Check the basics, such as your name, date of birth, country or region, and how you sign in to Microsoft. Microsoft's page says that because someone else had access, some settings were reset. It points you to connected accounts, forwarding, and automatic replies. Look at forwarding and automatic replies in particular. The FTC also says to look for email forwarding rules you did not create and delete them.

Review billing history. Xbox Support has a separate step for this, with guidance for charges you do not recognize and for charges you cannot find. Keep screenshots of anything odd. If a card was charged, your card issuer or bank is another place to raise it.

Step three: close the gaps for next time

Xbox Support's last step is about keeping the account secure. Its list includes:

• Updating the security info on your email address.
• Protecting your profile on consoles where it was saved.
• Adding security info to your Microsoft account.
• Updating your browser and device with the latest security fixes.
• Installing or updating virus, spyware, and malware protection.
• Making sure your browser's phishing filters are on.
• Teaching your family to spot scammers.

The FTC adds a few that apply to any hacked account. Sign out of all devices so anyone else logged in is removed. Turn on two-factor authentication if the account offers it. Check that your recovery email addresses and phone numbers are ones you control.

If your Xbox is shared with kids or other people in the house, the last item on Xbox's list, teaching your family to spot scammers, is worth a real conversation.

Tell your contacts

If the hacker used your profile to message people, the FTC suggests letting friends and family know. Tell them not to click links in messages from you and to ignore pleas for help or money. A short note on a social account or in a group chat is enough.

Where the problem may have started

One possibility is that your email and password were exposed in a data breach at some other site and then tried on your Microsoft account. Reusing a password makes that easier. It is only one possible cause, and phishing is another.

The FTC's IdentityTheft.gov has a page on what to do when your information is part of a data breach, including a section for passwords and account logins. If you reused the leaked password anywhere else, change it there too.

A free scan can show whether your email address appears in known breaches, with passwords shown masked. It will not prove how your account was accessed, and an empty result does not mean you are safe. It is simply one more way to find accounts that need a new password.

When to report it

If money was taken or your personal information was used, IdentityTheft.gov says that if you experienced a fraud, scam, or bad business practice, you can also tell the FTC at ReportFraud.ftc.gov. IdentityTheft.gov describes itself as the federal government's one-stop resource for identity theft victims, with checklists and sample letters. For card charges, call the number on the back of your card.

Be careful with anyone who contacts you offering to "recover" the account for a fee. Use Microsoft's and Xbox's own tools. A recovery attempt can fail, so keep your records and try again through the official forms.