> they detected a successful credential stuffing attack against the accounts and locked them And how providing a phone number can help Microsoft to distinguis

> they detected a successful credential stuffing attack against the accounts and locked them And how providing a phone number can help Microsoft to distinguish a real owner from an attacker?