Someone trying to sign in to my Microsoft account

Question

Beginning yesterday, I started getting text messages with a code for me to enter as I was signing into Microsoft I was not trying to sign in to Microsoft at that time It's happened dozens of times. Then. I get a phone call soon afterward. The text asking me if I was trying to sign in I have my sign in attached to a passkey. I know they can't get in, but how do I stop them from trying to sign in?

Answer 1

The repeated texts and calls mean someone (or something automated) is repeatedly trying to sign in using your account identifier, but they still need your second factor/passkey, so they cannot complete sign-in.

To reduce or stop these attempts and keep the account secure:

1. Do not respond to unrequested codes
   • Ignore all verification codes and prompts that you did not initiate. Without the code or your passkey, the attacker cannot get in.
   • This guidance applies both to personal Microsoft accounts and work/school accounts.
2. Review recent activity and secure the account
   • Sign in to your account and check the Recent activity page to confirm which sign-ins are yours and which are not.
   • If any activity is not recognized, follow the prompts there to secure the account (change password, review security info).
3. Strengthen sign-in with passwordless methods
   • Since a passkey is already used, keep it enabled and ensure no weaker methods are left that an attacker could exploit.
   • For additional protection and convenience, consider going fully passwordless using Windows Hello, Microsoft Authenticator, SMS/Email codes, or a physical security key as described in the passwordless guidance. This reduces reliance on passwords that can be guessed or phished.
4. Verify and clean up security info
   • Check the phone numbers, email addresses, and apps listed as security info on the account.
   • Remove any phone/email or authenticator app entries that are not recognized.
5. Expect some attempts to continue
   • Microsoft cannot fully prevent someone from typing the email/phone on a sign-in page, but the protections in place (2FA, passkeys, unusual-activity detection) block unauthorized access.
   • When unusual sign-in attempts occur, Microsoft will continue to send alerts (email/SMS) so that any real compromise can be detected quickly.

If the volume of alerts is very high and persistent, use the security pages to verify everything is correct, then rely on passwordless/strong MFA and continue to ignore any codes or prompts that are not initiated personally.

---

References:

• Why is Microsoft texting me?
• What happens if there's an unusual sign-in to your account
• Troubleshoot Microsoft verification code issues
• Common problems with two-step verification for a work or school account

Answer 2

@Gregory Hamilton said

I know they can't get in, but how do I stop them from trying to sign in?

By creating a Login Only Alias and remove the Sign-In Privilege from your current alias.

See the answer by "Hornblower409  Feb 27, 2026, 9:41 AM" in

https://learn.microsoft.com/en-us/answers/questions/5789093/i-get-a-few-2fa-notifications-from-canada-daily-us