
Hi
Welcome to the Microsoft community.
If you are using Microsoft Authenticator, it means that besides the PIN, this is the most secure verification method. If someone passes this verification, Microsoft will naturally consider him as the owner of the account and allow him to perform some operations related to security information. The priority of this verification method is very high and it is unlikely to be remotely attacked. Your current situation is actually because your phone was stolen and unlocked, not because there is a problem with Microsoft’s security protection (such as caused by network attacks), but because your phone was physically taken away and passed your phone’s security protection, which led to them being able to pass Microsoft’s verification. If the Microsoft Authenticator verification is passed, Microsoft will naturally think it is you who are operating, not that your phone is lost and unlocked and the illegal elements are using this software to pass the verification. In this case, you need to contact your local police to assist you in finding the illegal elements and solving your problem through investigating the IP address and other methods.
Best regards
Tommy Jin | Microsoft Community Support Specialist