Received Verification Code. Concerned

Question

I received a verification code I didn’t ask for. I understand it may be someone trying to access my account so I went in and changed my password. I requested a different login code and my “autocomplete” accidentally selected the suspicious code I was sent even though I deleted it. It rejected the sent code and took the one I requested after I received the suspicious one. Is my account still safe?

Answer 1

If you received a verification code that you did not request, it is wise to be cautious as it may indicate that someone is attempting to access your account. Since you have already changed your password, that is a good first step in securing your account. However, it’s important to ensure that the new password is strong and not similar to the previous one.

Regarding the situation with the autocomplete selecting the suspicious code, if that code was rejected and you successfully logged in with the code you requested, your account should be safe for now. However, it is advisable to take additional precautions:

1. Enable Multi-Factor Authentication (MFA): This adds an extra layer of security to your account.
2. Monitor Account Activity: Keep an eye on your account for any unauthorized activity.
3. Update Security Information: Make sure your recovery email and phone number are up to date in your account settings.
4. Check for Suspicious Activity: Look for any unusual login attempts or changes to your account settings.

If you notice anything suspicious, consider reaching out to Microsoft support for further assistance.

---

References:

• Respond to a compromised cloud email account
• Microsoft account security information

Answer 2

Hello,

Sign into the account here: https://account.microsoft.com, then go to Security to review the sign in activities. When you reviewed the account's sign in activities, Click into those labeled as "unsuccessful sign in", you can click on it to expand it to review the Session activity. If it is incorrect password, it won't generate a code. And there's nothing to worry about. If it is request denied xxx, that means this activity had your password entered correctly, and a code was generated, but it didn't pass the two factor verification. In the latter scenario, you want to change the password asap.

If you can NOT find any unsuccessful sign-in with the "request denied" labeling, it can mean that someone else left your contact information as their security info, usually due to typo. In this case, your account is not in any danger. Unfortunately there's also nothing you can do about it until this other user realized they needed to update their contact info.

Another way to find out which scenario is yours is to go to the account https://account.microsoft.com click on Security > Advanced Security options, set up authentication app instead. That way, if you continue to receive code via text or email instead, you would know 100% that it is NOT about your account, but someone else left your phone/email as their contact info due to typo.