A Microsoft verification code email that was not requested is typically triggered because:
- Someone is trying to access the account associated with that email address.
- Someone mistyped their phone/email when trying to sign in.
- A code that was requested earlier was delayed in delivery.
Do not use or reply to any verification code that was not requested. Without that code, an attacker cannot complete the sign-in, so the account remains safe.
If there is an old Hotmail/Outlook account that is still active, it is possible the email is related to that account. To be safe:
- Sign in directly (without using any links in the email) by typing
https://account.microsoft.comorhttps://account.live.cominto the browser. - Check recent activity and security info for that account.
- Consider strengthening security by going passwordless and using methods such as Microsoft Authenticator, SMS/Email codes, Windows Hello, or security keys.
If verification codes continue to arrive without being requested, going passwordless can reduce unwanted code prompts and improve security.
References: