User Getting Email With Single Use Code Theyt Did Not Request

Question

User is getting frequent emails from ******@accountprotection.microsoft.com with a single use code that have no correlation with his recent activity. This has been ongoing for several months and we are unable to track the origin through logs in Entra. His work account is not being used as a recovery account for for his personal account. Recommendations on how to attempt to remedy?

Answer 1

Hi @Steve LaVoie

Thank you for posting your question on Microsoft Q&A.

A single-use code is an authentication method used only for Microsoft personal accounts (not work or school accounts). If you receive such an email without requesting a code, it's likely that someone is trying to access your account

Recommended Actions:

1.Do not use or share the code with anyone. Since you didn’t request it, someone may be attempting unauthorized access to your account.

2.Immediately change your Microsoft account password to a strong, unique one. Use a mix of uppercase and lowercase letters, numbers, and symbols for better security.

3.Enable two-factor authentication (2FA) on your Microsoft account if you haven’t already. This adds an extra layer of security by requiring a verification code from your phone or another trusted device.

4.Check your Microsoft account's recent activity for any suspicious login attempts or unrecognized devices. You can find this information in your account's security settings.

5.If you continue receiving unwanted codes or suspect your account has been compromised, contact Microsoft Support. They can help secure your account and investigate any suspicious activity.

For more reference: https://support.microsoft.com/en-us/account-billing/how-to-help-keep-your-microsoft-account-safe-and-secure-628538c2-7006-33bb-5ef4-c917657362b9

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

Hi Steve,

Not sure if this applies, but the following works for personal MSAs to disable sign ins from a specific username.

This is a common problem since a few months - it is called MFA Fatigue attack. Via https://www.reddit.com/r/microsoft/comments/1aw...

Changing the username for your account to something obscure should stop it. Try this: Create an alias for login purposes only.

Designate this alias as the primary alias at: https://account.live.com/names/manage then disable sign-in capability for the other aliases here: https://account.live.com/SignInPreferences

You can still send and receive email from the old address.

Keep the new alias secret. Do not use the new alias for anything except login. When someone tries to login to your account, they will receive a message that the username does not exist. They can't hack your account if they don't know your username.

Be careful to not REMOVE your email address at the first screen. There you only want to create the new alias (click on add email) then make the new alias Primary (click on Make primary, NOT Remove).

Hope that helps, and rely on us for any further inquiries. All the best.