I got an email from Microsoft Security to my recovery account that someone from Vietnam had broken into my hotmail.account. I verified that my password no longer worked to get into the account. Then I went back to the recovery account and the Microsoft Security email that alerted me to the break in from Vietnam. There was a link to reset my password and recover my account. I clicked it and as I progressed through the variety of questions for my identity, (including dob, name, the id of the last email addresses I had sent a message to and their subject lines) I was asked if I had purchased a product from Microsoft. I answered yes. Then the next window said since I had bought a product from Microsoft I needed to give the credit card number I had used. At that point I got out of the web page.

Is this an actual Microsoft recovery question or a scam?

I'm subscribed to Office 365. Is there phone support from Microsoft I can turn to? (Google search pointed me to this forum) If so, what might that be?