Single-use code sent to personal gmail account that was not requested

A single-use Microsoft verification code that was not requested does not by itself mean the account is hacked, but it does mean someone or something tried to sign in using that email address.

Key points from Microsoft guidance:

1. Why the unrequested code was sent An unrequested verification code or sign-in prompt can happen when:
   • Someone is trying to access the account.
   • Someone accidentally entered the wrong phone/email when trying to sign in.
   • Delivery of a code or prompt that was requested earlier was delayed.
   This applies both to email codes and to prompts such as “Are you trying to sign in?” on Outlook mobile or other Microsoft sign-in flows.
2. What to do with a code that was not requested
   • Do not use or enter the code anywhere.
   • Do not respond to any verification request that was not initiated.
   • If a prompt appears (for example in an app), always choose Deny for any sign-in request not initiated. Microsoft states that if someone is trying to access the account, without the correct code or approval, the account remains safe.
3. How to verify the email is legitimate
   • Legitimate Microsoft account security emails are sent from the domain @accountprotection.microsoft.com.
   • For unusual sign-in alerts, a valid sender address is ******@accountprotection.microsoft.com.
   • If the domain matches @accountprotection.microsoft.com, the message itself is from Microsoft, even if the sign-in attempt was not.
4. Recommended next steps to protect the account
   • Sign in to the Microsoft account directly (by typing the address into the browser, not via the email link) and review recent sign-in activity using the official security pages referenced in the articles.
   • If any sign-in looks unfamiliar, follow the guidance in the “unusual sign-in” and “hacked or compromised account” articles (change password, review security info, etc.).
   • Ensure security info (recovery email, phone, and two-step verification) is up to date so alerts and codes continue to go to the correct contact methods.

As long as the code is not entered and unrequested prompts are denied, the account is protected from that specific attempt.

References:

• Can I trust email from the Microsoft account team?
• Using Outlook mobile to sign in
• Common problems with two-step verification for a work or school account
• What happens if there's an unusual sign-in to your account
• Troubleshoot Microsoft verification code issues

Hi, I'm John! I will help you with this.

If you did not request the code, do not use it and do not click any links in the email.

The one you shared does look genuine, especially since it’s coming from @accountprotection.microsoft.com, which is an official Microsoft domain. However, the most important part is confirming whether you actually made this change or not.

Reference: "Can I trust email from the Microsoft account team?" https://support.microsoft.com/account-billing/can-i-trust-email-from-the-microsoft-account-team-685fd302-f52f-1a9f-cc13-065dec46fe25

To help narrow down the issue:

Did you recently add a passkey or make any security changes to your Microsoft account?

1. If yes, then you can safely ignore the email.
2. If no, don’t click any links in the email just to be safe. Instead:

• Open a browser and go directly to the Microsoft account website by typing it manually or use https://account.microsoft.com
• Sign in and review your Recent activity https://account.live.com/Activity to check for any unfamiliar sign-ins.
• Review your security info and account aliases to make sure nothing was added without your knowledge: https://account.live.com/SignInPreferences
• If you see anything suspicious, change your password immediately and remove any unknown security methods.

To be safe, I recommend:

• Don’t click on any links or download anything from that email.
• Go directly to the Microsoft Account Activity page https://account.live.com/Activity and check your recent sign-in activity. If there’s nothing unusual there, then the message most likely isn’t from Microsoft.
• If you didn’t request any changes and the email is not officially from Microsoft, it’s a good idea to ignore or report the email as phishing.

I really hope this information is helpful.

Let me know if you have any further questions or concerns.

Click "Add comment" to let me know.

Regards,

John J.D.