Yes, an unrequested single-use (verification) code usually means one of the following:
- Someone is trying to access the account using the email or phone number.
- Someone accidentally typed the email/phone when trying to sign in to their own account.
- A code that was requested earlier was delayed in delivery.
Key guidance:
- Do not use or respond to any verification codes that were not requested.
- If the code was not requested, the account remains safe because the other person cannot complete sign-in without it.
- To reduce the chance of this happening again and to better secure the account, enable a passwordless sign-in method such as Windows Hello, Microsoft Authenticator, SMS or email codes, or a physical security key.
If unrequested codes continue, consider reviewing and strengthening security methods on the Microsoft account and moving to passwordless sign-in.
References: