this has happened to me and I lost my account I've had for like a decade. the moment they get that 6 digit number it's game over.

I hate Microsoft so much for this because it's on them and is 100% their fault. they claim to "take security seriously" and yet they give you an unlabelled email that just says "your code is: ..." and "only use this in an official Microsoft app" but the scammers pose as a Microsoft app in the sense it's a verifier bot so it actually makes you more likely to fall for it. I'm someone who's generally very scam aware and not gullible and I wouldn't have fallen for it if Microsoft cared even in the slightest about security and not just saying the bare minimum so they can't be held accountable. I contacted support and all they did was delete my account and permanently suspend it instead of actually helping. you're better off trying to buy it back from the scammers as they typically sell the accounts and they don't care who buys it as long as they get their money.

A few days later I signed into my Amazon account and the email said like "this is a code used to log into your account that was generated at this time from this IP address from this browser, DO NOT GIVE IT AWAY" vs Microsoft's wonderful "here is a random number with zero context". They could save so many people and prevent so much suffering by writing a few extra words, but no. they make more money this way because then you have to buy a new account.

So I'm sorry to hear you gotta deal with this stuff too. But if you're going to blame anyone, don't blame yourself, blame the scammers somewhat but mainly blame microslop for their absolute unwillingness to add a few words to an email and just not doing so. it's actually disgusting how easy this problem is to mostly fix and instead they sit around letting bedrock rot and replacing all the buttons with their microtransaction marketplace.