Account hacked and recovery form always says insufficient

I'll add to Bulldog's information by saying, how do they know it wasn't actually you who logged in from that other location where the password and other items were changed?

I was personally traveling throughout multiple countries in Southeast and Northeast Asia for over two months earlier this year, and logged into my accounts from all over that region, though I was using the same phone I've consistently used in the US while doing it.

That's the real problem with what the typical consumer user believes, since today's world is highly mobile and often they themselves have traveled elsewhere on the past, but no one thinks about these issues when assuming that static IPs or really anything else means anything regarding their identity.

The reality is just as Bulldog stated, it's the several methods of alternate verification that Microsoft provides that matter and even the older techniques of 2-Step verification like Microsoft Authenticator are often being bypassed nowadays when the often gamers drooling for a game cheat or another goodie like a supposed new game happily hand over both their password and Microsoft 8-digit code freely to the fake Dis cord server or other website that prompts for it.

I don't know the specifics of your breach, but obviously there was one, whether malware or false website, that collected and abused that simple username and password information in order to gain control of the account, which as Bulldog stated effectively belonged to the attacker as soon as they started making the changes that made it theirs.

Unlike Microsoft though, some of (not all, neither Roblox nor Rockstar Games make recovery easy if you don't have alternate verification) the gaming sites make recovery easy, but that's just because their entire model is designed for low security, so they expect that people will lose their accounts and so have decided to use what's not truly identifying information like invoices or other random information as identity.

Microsoft has tried to make it possible for the account owner to recover their accounts using the Self-Helper app, but I've rarely seen this succeed when all of the security information has been changed, even though it's claimed that this may be possible. I suspect that the thieves have found a precise combination and sequence of events that are what makes it permanent and Microsoft themselves state clearly in several of these support documents that their Support agents can't any longer make manual changes required to reverse it, since that was obviously recognized as another potential hole in account security long ago.

Unfortunately, Microsoft eventually had no choice other than to automate this process for that and several reasons, so that's the not so friendly online world we live in today, where responsibility for your account is solely yours, using the tools that Microsoft provides.

In the future, having a Windows system with Windows Hello as well as using the associated Passkeys for as many websites as support them is really the most secure and easiest way to protect your online access to Microsoft, which I've been using portions of since 2019 when I first got this Microsoft Surface Go tablet I'm using to type this, though I've only recently begun to seriously try using passkeys due to the flaky operation of those when they first released a couple years ago.

This is really the only way forward for true security though, since passwords have been useless for security for many years and even the early forms of 2-Step (2FA) authentication have been breaking down lately as I mentioned, since people are always easier to fool than machines and technology.

Rob