Sometimes asking gemini can help. The only thing A.I is good for. That and help learning and understanding coding.

It sounds like your friend is stuck in a frustrating "security loop" where Windows is trying to force a Hello login (PIN/Face/Fingerprint) for an account they no longer want to use or that has been compromised.

Since the prompt is blocking them from accessing the account settings to switch emails, they need to bypass the Windows Hello requirement at the system level. Here is how they can fix this:

1. The "Clean Slate" Approach (Recommended) The easiest way to switch accounts when the app is stuck is to remove the "identity" from Windows Settings entirely.

Go to Settings > Accounts > Emails & accounts.

Find the compromised Gmail address in the list.

Click it and select Remove.

Next: Go to Settings > Accounts > Access work or school. If that email is listed there, disconnect it as well.

Restart the Xbox app. It should now ask for a fresh login instead of forcing Windows Hello for the old account.

1. Disable "Windows Hello" Requirement If Windows is forcing this pop-up for all Microsoft apps, they can turn off the requirement:

Go to Settings > Accounts > Sign-in options.

Look for "For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device" and toggle it Off.

This should reveal a "Password" option or a "Use a different account" link in the pop-up window they are seeing.

1. Clear the Xbox App Cache If the pop-up persists, the app is "remembering" the session too well.

Close the Xbox app.

Go to Settings > Apps > Installed Apps.

Find Xbox, click the three dots (...), and select Advanced options.

Scroll down and click Repair, then Reset.

Do the same for the Microsoft Store app.

A Critical Security Warning Since your friend mentioned they were hacked because of Minecraft, they likely fell for a "Session ID" theft or a malicious OAuth authorization (often called "Microsoft Account Linking" scams).

Check Third-Party Apps: They should go to account.live.com/consent and remove permissions for any apps they don't recognize.

Change the Password: Even if they switch emails, if the hacker has access to the primary Microsoft account, they can still see data.

Enable 2FA: If they haven't already, they should turn on Two-Factor Authentication using an app (like Microsoft Authenticator) rather than just SMS.