1

If you want to update your security info (such as a password). You need to verify your ID with your phone or another email. If you don't have any connected to you account (or forgot them), you can add them. After doing this you need to wait 30 days for verification and you can not change your password (and other security settings).[1]

If a hacker or someone has your password, you need to wait 30 days. Before you can change it. Giving the hacker free access for 30 days.

Why would a company still choose to make you wait 30 days?

  • As a side note. Thats a good example of why "One ring to rule them all" policy is risky. If they get limited or full access to the single account used as account recovery for several services it is a fair assumption to consider all services could be compromised. And restoring access to all services could be a pain in the ass. – bradbury9 Apr 13 '18 at 10:06
1

The 30-day waiting period helps Microsoft stop unauthorized people from trying to completely take over an account that isn't theirs. For example, an unauthorized person obtaining an account password through phishing or shared passwords across third party platforms. This waiting period gives the real account owner enough time to be alerted of any major changes and to cancel it if they didn't make those changes.

During this 30-day period, you'll still be able to access most Microsoft services. You won't, however, be able to do things that require a security code, like changing your password, viewing billing information, or buying new apps or games from Microsoft Store or on Xbox.

After the process of resetting your security information has started, you must wait the full 30 days for it to complete. However, if you regain access to a piece of your original security info, you can cancel the replacement yourself.

Source: Official Microsoft Source

  • 1
    Regardless if it's a smart move or not, that is their reason – toom Apr 13 '18 at 9:33
  • But this also give the hacker 30 days to undo anything the real user did. Or am I missing something? – SirDuckduck Apr 13 '18 at 9:38
  • 1
    Indeed, access to the account is granted, and the attacker could do several things, but no full control is given and the victim could react to the credential theft without economic implications (as long as MS is concerned). If the email has sensitive messages tha could help impersonate or password recovery other services it could be troublesome imho. I can not buy myself at microsoft store, but there goes paypal! – bradbury9 Apr 13 '18 at 9:47
  • As @bradbury9 it does deliver some security for your accounts and the settings but it also guarantees some free 'playtime' for the hacker – toom Apr 13 '18 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.