I received a verification code I did not request.

Question

I received a code on 21/05/26 which i did not request. Also my gmail address was used a few weeks earlier to access an online conference meeting I had no knowledge of and my Windows security PIN does not work and I have not changed it. I have changed my email password. Without my usual PIN, I cannot change it to a new one. I have a Norton subscription, which says I have no threats and everything is working after a full scan. Am I compromised?

Answer 1

Log into your Microsoft account on this link to check the recent activity on your account, do you find any attempted logins from locations/countries you do not recognize, and if so, is it indicated the attempted logins were successful.

https://account.live.com/Activity

Answer 2

Unrequested verification codes and sign-in prompts usually mean either someone is trying to access the account or another person mistyped an email/phone number. On their own, they do not prove compromise, but combined with a non-working Windows PIN and unknown use of the email on a conference service, the situation must be treated as a potential account compromise.

Take these steps in order:

1. Treat unrequested codes and prompts as suspicious

• Do not use or respond to any verification codes that were not requested.
• If any sign-in prompt appears (for example, “Are you trying to sign in?”), always choose Deny if it was not initiated.
• If verification codes arrive by email, verify that they come from @accountprotection.microsoft.com and that they refer to an account that actually belongs to the user. If the account or request is not recognized, ignore the code.

2. Secure the Microsoft account and email

• The email password has already been changed, which is correct. Ensure the new password is unique and not reused anywhere else.
• Review security info on the Microsoft account (phone numbers, alternate emails, sign-in aliases, and registered authenticator apps) and remove anything that is not recognized. Use a known-good device and network when doing this.
• If unrecognized phone/email security info is shown when trying to get a verification code, confirm the correct account name and domain are being used (for example, .com vs .co.uk). If the account details are correct but the security info is not, follow the account recovery guidance linked in the context.

3. Address the Windows PIN issue

• A non-working Windows PIN does not by itself prove compromise; it can also result from local profile or credential issues. However, because there are other suspicious signs, treat the device as potentially at risk.
• Since the PIN cannot be used, sign in with the account password instead (if available) and then reset the PIN from Windows settings. If sign-in is not possible at all, use another trusted device to secure the Microsoft account first, then work through Windows sign-in recovery options.

4. Check devices and apps beyond Norton

• A clean Norton scan is helpful but not definitive. Ensure all devices that access the Microsoft account or email are fully updated and scanned.
• If any device shows repeated suspicious behavior (for example, drafts or sign-ins appearing without action), consider backing up important data and performing a full reset of that device.

5. Monitor and reduce future risk

• Watch for additional unrequested verification codes or sign-in prompts. If they continue, consider moving toward passwordless sign-in methods such as Microsoft Authenticator, Windows Hello, or security keys, which are more resistant to password guessing and phishing.
• Inform close contacts to be cautious about unexpected messages or meeting invites that appear to come from the account until confident everything is secure.

Whether the account is definitively compromised cannot be confirmed from these symptoms alone, but the combination of unrequested verification code, unexplained use of the email address, and PIN issues is enough to justify treating this as a potential compromise and following the steps above to secure both the account and devices.

---

References:

• Common problems with two-step verification for a work or school account
• Troubleshoot Microsoft verification code issues
• Why is Microsoft texting me?
• Can I trust email from the Microsoft account team?
• Using Outlook mobile to sign in
• Need more help? (Troubleshoot Microsoft verification code issues)