SECURITY

Securing Guide

Follow the guide below to safely take over your account, change its info, and secure your purchase.

SECTION 1

How to take over your account

Use the recovery code to reset the password and put a fresh recovery email on the account.

  1. 1

    Open the Microsoft password reset page

    Head to account.live.com/password/reset.

  2. 2

    Enter your email

    Input the email from your account format, then click ‘Next’.

  3. 3

    Click ‘I don’t have any of these’

    Microsoft will offer a couple of recovery options, but none of them are yours yet, so click ‘I don’t have any of these’ at the bottom of the page.

  4. 4

    Enter your recovery code

    Paste the recovery code from your account format and click ‘Next’.

  5. 5

    Set a new password and security email

    Choose a strong new password and a new security email you control (a personal Gmail / Outlook works fine). Submit the form to finish the takeover.

SECTION 2

Lock down the account

A short cleanup pass that boots the previous owner off every device and closes every recovery vector they could use to get back in.

  1. 1

    Sign out of every device

    Sign in to login.live.com with your new password, then open the Devices tab. Click ‘Sign out everywhere’ and remove every device you did not add yourself.

  2. 2

    Check recent activity

    Open the Activity page and skim the last few entries. If you see a sign-in from an unfamiliar location right after your takeover, report it on the same page.

  3. 3

    Turn off email forwarding

    Some accounts have hidden rules that forward every incoming email to a third party. Go to Outlook forwarding settings and disable any active forwarding address.

  4. 4

    Remove old recovery methods

    Open Manage how I sign in and delete every phone number, security email, and authenticator app that is not yours. Keep only the recovery email you added in Section 1.

  5. 5

    Revoke third-party app access

    Visit App access and revoke every connected app you do not recognize. Old grants can be used to bypass password changes, so remove them all.

  6. 6

    Generate a new recovery code

    Back in your security settings, click ‘Generate a new code’ under Recovery code and save it somewhere offline. This invalidates the original code that came with the account.

  7. 7

    Re-enable two-step verification

    In the same security panel, turn 2FA back on and bind it to an authenticator app you control (Microsoft Authenticator, Aegis, 2FAS — any of them work). This is the final seal against future takeover attempts.

  8. 8

    Confirm your Minecraft profile

    Open your Minecraft profile to verify the in-game name (and cape, if applicable) are intact. You can change the username from here after the standard cooldown.