So someone from Tunisia managed to log into my Microsoft account (two factor authentication set up). I have only ever logged in from the UK.

Managed to order a £25 gift card which flashed up on my PayPal. Logged straight back in and changed password and deleted all payment methods.

Microsoft refusing to refund. Surely that can’t be right? Never been hacked before and think this is really unfair unfair.

Anyone else had this happen to them? Any idea how it is done or what I can do to prevent?

Have you tried Paypal?

Yes they are not interested either as my PayPal account was linked to my Microsoft account so they say it was ,authorised,

Interesting how little these firms care or help you when you need it compared to how much you spend with them …

Had a similar thing last year someone hacked my xbox /Microsoft account, they bought 2 £50 xbox live vouchers etc through paypal , only flagged up when i checked my account, paypal refused to refund saying the correct password etc had been used so they believed it was me … which it wasnt !, they had also set up a recurring £50 a month xbox live account , which i managed to cancel before they took any money, still got taken for £100 in the end , which paypal or microsoft refused to refund ?

Waaay too many things don’t make sense here.

Amongst several other questions (including, how do you know they’re in Tunisia?): how did they defeat 2FA?

As Cougar says, how have they bypassed 2FA? I assume MS thinks that’s impossible so take a default position not to refund.

As for what to do, assuming you can’t get to the bottom of how they access the account in the first place, is log it with Action Fraud and then start spamming MS’s XBox twitter feed with abuse/constructive criticism (probably won’t get you anywhere but hey why not).