For a secondary Microsoft/Outlook account where the old phone number is no longer accessible and normal verification keeps looping, only the documented self-service recovery paths can be used.
Follow these steps based on the documented behavior:
- If the password is known but security info (old phone) is lost
- Start sign-in to the affected Microsoft account.
- At the "Verify your identity" prompt, choose I don't have any of these.
- Follow the prompts to replace the security info (phone/email).
- After successfully replacing all security info, the account is placed in a 30‑day restriction period before full sign-in is allowed. During this time, existing security info can still be used if found, but using it cancels the update.
- "If you know your password, but have lost access to all your security info" → begin sign-in → select I don't have any of these → follow instructions to replace security info → wait 30 days before being able to sign in.
- If the password is not accepted or recovery keeps forcing the old phone
- Use the Microsoft account recovery form. This is the only supported path when both password and security info are effectively unusable.
- Before filling it out, review the guidance in Help with the Microsoft account recovery form.
- Use a device and location where this account has been used before (for example, the phone where the account is still signed in) to improve the automated checks.
- Go to the Account recovery form and submit as much accurate information as possible.
- If the account has very little email activity, focus on any details that do exist (old passwords, approximate creation date, any messages or contacts you do remember). The system can only evaluate the fields it asks for; screenshots or extra evidence cannot be sent elsewhere.
- If there is no access to any security info and the recovery form fails
- The documentation states that if two-step verification is enabled and none of the alternate methods are accessible, support agents cannot override or reset the account for security reasons.
- For accounts without two-step verification, if none of the verification options are recognized, use the Sign-in Helper and then the recovery form as directed.
- There is no alternate channel (email, chat, or phone) where additional custom evidence (like screenshots) can be submitted to bypass the automated recovery.
- If rate limits or lockouts are hit
- If too many attempts have been made (codes, form submissions), the account can be temporarily locked.
- Wait the indicated lockout period (often about 24 hours) without further attempts, then retry from a familiar device and network.
Key limitations from the documentation:
- Support agents are not allowed to send password reset links or change account details for consumer Microsoft accounts.
- All recovery is handled by the automated systems via:
- "I don't have any of these" → replace security info (with 30‑day wait), or
- The Microsoft account recovery form.
- If the recovery form cannot verify ownership with the data provided, there is no additional escalation path documented for adding extra proof.
In this situation, the only options are:
- Use "I don't have any of these" during sign-in (if the password is still known) and complete the 30‑day security info replacement process, or
- Continue carefully retrying the account recovery form from a known device/location with the best possible answers, respecting lockout limits.
References:
- Help with the Microsoft account recovery form
- Troubleshoot Microsoft verification code issues
- Common problems with two-step verification for a work or school account
- Can't sign in to my email - Microsoft Q&A
- I need to speak with a real person and it seems impossible. - Microsoft Q&A
- My personal hotmail account hacked by hacker with authentication app enabled. - Microsoft Q&A
- Locked out of my Outlook account and recovery options not working - Microsoft Q&A