Why is account recovery impossible when TSV is enabled?

Question

Why is account recovery impossible when TSV is enabled?

Oliver 5

I feel like, if account safety is important to Microsoft, there would be some way to recover accounts that have two step verification enabled. It seems like a massive oversight, maybe I’m crazy but people have connections to these accounts that include thousands of hours of work, game licenses, verification of other accounts, etc.

It just doesn’t make me feel safe that my account got locked and I have since lost complete access to it forever because I was trying to keep it more safe by enabling two step verification. In the future it just would feel bad to enable it at all, even though it’s considered safer for daily use.

Imagine a prison where the inmates are kept under close supervision and the goal is prison security, one person is found deviating from security protocol, whether they meant to or not, and they are put in solitary confinement FOREVER. The difference between a Microsoft account and a human is blatant but the idea isn’t that far fetched. Microsoft accounts do have value beyond just information storage.

I would like to know your thoughts, and hopefully I can get my account reinstated even though it will be “permanently suspended” because I made some obscure mistake that I don’t even know I made.

0 comments

1 answer

Your answer

Answer 1

Rob Koch 26,070 Volunteer Moderator

It's not impossible, you just have to have at least 2 alternate methods of verification available even if some of these are lost, which in most cases means at least 3 and better off 4 or more optional methods when available.

As a past network administrator and security professional, this is obvious to me, but unfortunately something that many consumers simply don't seem to get, regardless of the fact that Microsoft typically prompts them to add more verification methods whenever they get the chance.

I personally have the Microsoft account password which I won't remove until Microsoft realizes the precise issue you're bringing up here, the legacy SMS phone option that's currently in process of being dropped, a secondary Gmail used only for verification and not stupidly synced as the Microsoft account name that's just asking for trouble like account theft or loss since then it's not useable as an alternate method (the Microsoft account is legacy MSN domain), Microsoft Authenticator backed up to the Google cloud for recovery, Windows Hello Face (camera) and PIN on a Microsoft Surface Go tablet which also uses a Passkey for background login to the account (both that device and another without a camera are registered as trusted devices in the account), and lastly a Microsoft account Recovery key which may not be useable since it's not actually listed among the verification methods, but really should be since it acts as a form of identity that supposedly only the account owner should know.

The chances I wouldn't have at least 2 of the above verification methods available is unlikely, at least once I'm home if the house hasn't been destroyed with all of my devices including the phone contained inside it. But that's why the Recovery Key should still be useable as a verification backup if it isn't. since not everyone has the smartphone or other hardware available for things like Windows Hello, and it's something you could print out and store offsite in a safe deposit box for example.

Unfortunately, many people are learning these technical issues with account security and verification methods the hard way, which hopefully they'll use as a learning experience to be better prepared in case something catastrophic happens to them in the future.

Another option you might consider for the future is a combination of a Passkey with Passwordless account option, since though that removes the password as a verification method entirely, it only leaves less easily phished or otherwise stolen methods, while moving ahead with the generally safer Passkey method that Microsoft and other vendors are supporting since it's phishing resistant. It also would remove the risk that you lose the account due to 2FA.

Rob

Oliver 5 Reputation points

2026-09-06T18:33:15.9266667+00:00

I have access to all my security information, yet the account was locked and permanently suspended anyways.
Oliver 5 Reputation points

2026-09-07T02:16:04.9066667+00:00

As I stated in my reply, I have two additional methods of verification, yet the account remains unsalvagable…
Rob Koch 26,070 Reputation points Volunteer Moderator

2026-09-07T21:32:48.1966667+00:00

Then the issue isn't specifically (only) two-factor authentication, but likely some other specific issue like all of the security verification items having been changed, since that makes it impossible for anyone within Microsoft being able to aid you in fixing the issues, since none of the Support agents are allowed to make manual changes to Personal accounts any longer.

That policy change by Microsoft within the last few years made it impossible to recover some accounts that have been modified in certain specific ways, leaving even the more technically capable account support unable to do anything other than suspend these accounts permanently. From your description this sounds like what has happened in your case.

To be clear, you're describing why you don't like the fact you've lost your account, but like most gamers who've lost theirs as well, haven't described whatever series of events led you to lose control of the account in the first place.

In most cases, either malware was invited into the system via game cheats or similar questionable software downloads, or the account owner was either phished directly for their username/password and 2FA credentials, or indirectly by tricking them into believing they'd get something for free by logging into a fake alternate gaming site often via Discord.

This is how people literally give away their accounts to thieves and why I suspect that Microsoft was forced to set these quite strict rules regarding account recovery, since there's simply no way they could hope to keep up with hundreds of people losing their accounts daily.

Rob
Vigil, Francisco 0 Reputation points

2026-09-09T12:17:35.0766667+00:00

Rob I think you might not be updated on this phenomena. I have TSV set up, no email describing any security information changed, which I did receive immediately when my account was compromised a few months ago. I accidentally mess up sign attempts to my computer after a pin required sign in on my device and my account gets locked when I go try to reset my pin. But when this happens 2 of my 3 TSV methods are disabled (email and text) so there was never any chance of TSV saving this, and for someone to have comprised my account they would have also had to have passed this barrier. Then support tells me plainly:

“We received your service request and after review, I found Two-Step Verification (TSV) has been enabled on the account. Unfortunately, when TSV is turned on, we are unable to assist with an account recovery as TSV takes the account recovery completely out of control of customer service. We are unable to remove the TSV or make any changes to the security information on the account due to security protocols set up on the account and accepted in the MicrosoftServices agreement when the account was created.

When my account was taken last time I was told explicitly that I couldn’t get my account recovered because my recover information was changed but their given reason is not this, simply just boilerplate inability due to TSV. Despite the fact that the account lock seemingly disables the use of TSV by text or email.
Rob Koch 26,070 Reputation points Volunteer Moderator

2026-09-09T18:48:58.4933333+00:00

You're correct Francisco, I've never seen this precise set of events causing both an account lock which also results in the disabling of both text and email verification methods, though those are likely to be common backup methods for many consumers.

Based on your description it sounds as if the Windows Hello PIN method was also triggered as part of the flow, contributing to the lock, though I'm not fully clear how that factored into the login failure, since I'd simply have typed my pre-created PIN which has existed as backup since setting up the Face (camera) option when I first received the device several years go.

I can see why some combination of added failures might contribute to the lockout, but for clarity, it appears it's not a simple case of a lockout due to the original TSV or the Authenticator app, as most often creates these issues.

Was your own failure the result of problems setting the PIN or was that already set up and either failed or was also reset somehow by the initial lockout?

Rob