An Xbox account is a Microsoft account. That means recovery happens through Microsoft’s account system, and the same login may also protect purchases, subscriptions, OneDrive, email, and Windows devices.
Does this affect you?
Use this for Xbox consoles, Xbox on PC, the Xbox mobile app, or Microsoft account sign-in when the password is forgotten, recovery details changed, or purchases and gamertag activity look unfamiliar.
If you forgot the password
Use this when nothing looks tampered with.
- On the Xbox console or app, choose Forgot my password, or go to account.live.com/password/reset in a browser.
- Enter the email address or phone number tied to the Microsoft account.
- Use the verification code sent to the recovery email or phone on file.
- Create a new password and sign in again on the console or app.
- If two-step verification is enabled, enter the required code as well.
- If the recovery contact shown is unfamiliar or unreachable, treat the account as possibly compromised and use the next method.
If someone else has access
Use Microsoft’s compromised-account recovery path.
- Go to account.live.com and try to sign in.
- If you can get in, immediately open Security > Change password and set a new unique password.
- Open Security > Advanced security options and remove recovery phone numbers, emails, or methods you did not add.
- If you cannot sign in, go to account.live.com/acsr and complete the account recovery form.
- Include old passwords, previous emails, your gamertag, approximate account creation details, games in your library, and billing or purchase information.
- After recovery, review Microsoft Store and Xbox order history for unauthorized purchases and report them to Xbox Support.
More control
Enable two-step verification
At account.microsoft.com/security, turn on two-step verification. It protects Xbox and every other service using the same Microsoft account.
Prefer Microsoft Authenticator
SMS codes can be vulnerable to SIM swaps. Microsoft Authenticator can generate codes on the device and approve sign-ins without relying only on text messages.
Keep Security info current
The phone and email under Security info determine whether password reset is quick or becomes a manual recovery case. Update them before they go stale.
Remove old devices
Under Devices, sign out or remove consoles, phones, and PCs you no longer own so they do not remain trusted access points.
Sources
- Microsoft Support – Recover your Microsoft account (2025)
- Xbox Support – My Xbox account may have been compromised (2025)
- Microsoft Support – Set up two-step verification (2025)