John Curtin had everything on his Microsoft email account: his banking information, his mortgage paperwork, and a folder with his family’s addresses and numbers. He was a paying customer, too, shelling out $84 every year for an Office 365 subscription.
But apparently his money meant nothing to Microsoft, which locked him out of his account for what it called “unusual activity” and wouldn’t let him back in, no matter what he did.
“I need to get back into my account,” he told me. “I’m lost without it.”
Let’s pull back the curtain on this case:
- Can a company legally lock you out of a service you’re paying for without a human review?
- How do you get your account reinstated?
- What’s the best way to avoid a lockout?
“I’ve had this address for 20 years”
Curtin is no ordinary Microsoft customer. As an IT technician, he’s spent his career navigating the back alleys of technology.
But one day, for reasons he can’t explain, he found himself on the wrong side of Microsoft’s automated security gates. That’s when he discovered that his status as a paying customer and his expertise in IT didn’t mean anything.
“I’ve had this email address for 20 years, and I have a lot of personal information that I need to get back,” Curtin told me.
Before we go any further, let’s pause to note that storing all of your personal information in the cloud, without any kind of redundancy, is problematic. Your email provider could easily decide to lock you out, which would render it impossible for you to retrieve your data.
Curtin’s Microsoft account was the cornerstone of his digital life. It held everything, including a visa application that needed his immediate attention.
His nightmare started about a month ago when Microsoft notified him that it had detected “unusual activity” on his account. Suddenly, he went from a valued customer to a digital trespasser. Despite providing the exact payment details and dates for his subscription, the automated “recovery” bots remained unimpressed.
Can a company lock you out of your account?
We get questions almost every day from people who are trying to get into their disabled accounts. These companies have completely outsourced customer service to algorithms that lack common sense, creating a kind of doom loop for their customers.
That’s what happened to Curtin. He submitted multiple “account recovery” forms, only to be told the information—including his payment history—was not sufficient.
When he tried the account reinstatement route, he was initially met with silence or redirected back to the same recovery forms that had already failed him.
“Microsoft is being unreasonable,” he says. “They were asking me for account details that I couldn’t remember.”
Is this legal? Yes it is. Buried in the terms of service for your account is the language that gives a company like Microsoft the license to do this.
I’ve been stuck in Microsoft’s account recovery process before, and it’s no fun. The system asked me to recall old passwords that I couldn’t have possibly remembered and ultimately prodded me into setting up a new account recovery process with an authenticator app. And to be honest, I’m worried that I might get locked out of my own Microsoft account because I had to save the authenticator backup information to my laptop, and I’m not sure where I stored it.
So, bottom line, I feel Curtin’s frustration. I think maybe we all do.
What can you do if you’re locked out of your Microsoft account?
While these cases are notoriously difficult, there are a few known remedies:
The account recovery form. This is the first line of defense. It uses knowledge-based authentication to verify you. Tips from Microsoft include using a familiar device and location and being as specific as possible with email subject lines.
The account reinstatement/appeal form. This is a separate process for accounts suspended for activity or security reasons. Unlike the recovery form, this sometimes reaches a human safety or online safety team.
Social media callouts. Sometimes, tagging a company’s official support handle on X can trigger a manual review.
We also maintain a database of executive contacts for major tech firms on this site. While they won’t always override a security lockout, they are a vital part of creating the paper trail I need in order to get involved.
NOTE: As a general rule, our advocacy team doesn’t get involved in account recovery cases. But we try to offer the resources to help you get the help you need.
My best advice for avoiding a lockout
Almost anything can set off a fraud-detection algorithm. A few days ago, my Facebook account locked me out because I flew from New Zealand to Australia. I didn’t care; I’m trying to get off Facebook anyway. Eventually, the problem fixed itself.
And that’s your best-case scenario: The system realizes it got the wrong guy and restores your account on its own. AI is making the systems smart enough so that they can spot a mistake and fix it without any human intervention.
So here’s my straightforward advice: Don’t do anything that makes you look like a criminal. That includes sending out mass mailings, visiting sites on the dark web, or changing your location frequently using a VPN. (If you don’t know what any of those things are, chances are you’re not doing them, so you’re fine.) But don’t look like a bad guy on the internet and you’re less likely to have your account frozen.
The strategy is a little different for social media accounts and e-commerce sites. There, your account can get frozen for violating your terms of service, which could really be anything. I deal with lots of readers who lose access to their Walmart accounts because they returned too many items they bought online, for example.
Will Microsoft do the right thing?
I contacted Microsoft on Curtin’s behalf. I pointed out the obvious: Here was a 20-year customer with a paid subscription who was being held hostage by a bot.
A day after my team got involved, Microsoft finally reached out to Curtin and reinstated his account.
“I am now backing everything up to non-Microsoft related options,” he told me. “Lesson learned!”
It shouldn’t take a syndicated columnist to remind a trillion-dollar company that its customers are people, not just data points. But as long as the bots are in charge, I’ll be here to help you fight them.
Have a question about this story? Tell us what happened — we read every comment.
Join the conversation
