Random OTP recieved

Question

I haven't recently signed in on a new device, switched out my router, or requested a password reset, but this morning at 7:31 I received a text saying:

Use [##] as Microsoft account password reset code

This is very unusual because I don't give out my number, and when I checked my account activity the only entry was from exactly 1 month ago, presumably from my laptop.

It is also possible that it's from my school account, which there were also no unusual sign-ins on.

Answer 1

Hello

If you can NOT find any unsuccessful sign-in with the "request denied" labeling, it can mean that someone else left your contact information as their security info, usually due to typo. In this case, your account is not in any danger. Unfortunately there's also nothing you can do about it until this other user realized they needed to update their contact info.

Another way to find out which scenario is yours is to go to the account https://account.microsoft.com click on Security > Advanced Security options, set up authentication app instead. That way, if you continue to receive code via text or email instead, you would know 100% that it is NOT about your account, but someone else left your phone/email as their contact info due to typo.

Or, if someone knows your email address, they can always try the "forget password" option to trigger a code, which doesn't mean they have your password now, becuase you have to approve the code for them to start the password reset process. In this scenario, your account is still safe and protected, thanks to 2FA.

Answer 2

The text message is most likely a genuine Microsoft verification/password reset code that was triggered either by:

• Someone else entering the phone number by mistake when trying to sign in or reset a password, or
• Someone intentionally trying to access the account and using the phone number as the verification method.

Key points from Microsoft’s guidance:

1. Microsoft does send verification codes by SMS
   • Microsoft may send a text when a password reset or sign-in verification is requested, especially if two-step verification or phone-based security info is configured.
   • Codes can be sent even if the request came from a different device or app than normally used.
2. Unrequested codes can indicate someone is trying to access the account
   • If a Microsoft verification code is received that was not requested, Microsoft explicitly notes that this can mean:
     • Someone is trying to access the account, or
     • Someone accidentally entered the wrong phone/email when trying to sign in.
3. What to do now
   • Do not use or share the code.
   • Sign in directly (not via any link in the SMS) to the Microsoft account security pages:
     • For personal Microsoft accounts: go to the Security basics page and review Recent activity.
     • For work/school accounts: go to the My Account portal → Recent Activity and review sign-ins.
   • If any unfamiliar or suspicious sign-ins are found, immediately change the password and review/update security info (phone, email, and any authenticator methods).
   • If no unusual sign-ins appear, treat this as either a mistaken entry of the phone number by someone else or a blocked attempt that did not complete.
4. Treat suspicious messages carefully
   • If unsure whether the SMS is genuine, do not click any links in it.
   • Access the account only by manually entering the official URLs (such as https://account.microsoft.com or https://account.live.com) in the browser.

In short, an unexpected Microsoft password reset code usually means someone (legitimately or not) tried to use that phone number for verification. The safest response is to ignore the code, review recent activity, and ensure the account password and security info are up to date.

---

References:

• Why is Microsoft texting me?
• What happens if there's an unusual sign-in to your account
• Check the recent sign-in activity for your Microsoft account
• View your work or school account sign-in activity from My Sign-ins
• Can I trust email from the Microsoft account team?