Getting highly frequent "Use verification code..." SMS messages even though I'm not trying to sign in

Question

I'm receiving multiple Microsoft SMS messages every day saying "Use verification code...", even though I'm not attempting to sign in to any Microsoft account. This is becoming a major security concern.

I have three Microsoft accounts (three Windows accounts and three paid Microsoft 365/Office accounts): two for work and one personal. All three accounts use the same phone number for 2-step verification.

I have two questions:

1. How can I determine which account a verification code SMS is for? Since all of my accounts share the same phone number, the SMS doesn't indicate which account the code belongs to. Is there any way to identify the account that triggered the verification request?
2. Why don't these attempts appear in my Recent Activity page? I've checked the Recent Activity page for each account but cannot find any failed sign-in attempts that correspond to the times I receive these SMS messages. Are there additional sign-in logs that aren't shown on the Recent Activity page, or could these verification requests be generated without appearing there?

Has anyone experienced this, or can Microsoft explain what's happening?

Answer 1

Hi @SEM,

Based on your follow-up, the key point is that there isn’t a supported way to identify which Microsoft account a verification code SMS belongs to when multiple accounts use the same phone number as an authentication method.

Microsoft’s verification SMS intentionally contains only the one-time code and doesn’t include the account name or email address. This helps avoid exposing account information through SMS. As a result, the SMS itself can’t be used to determine which account triggered the verification request.

The only reliable way to identify the account is to correlate the time you received the SMS with the sign-in activity for each account:

• For a personal Microsoft account, review the Recent activity page.
• For a work or school account (Microsoft Entra ID), review My Sign-Ins (if available) or ask your Microsoft 365 administrator to check the Microsoft Entra admin center > Sign-in logs.

Since you’ve now found matching sign-in activity for one of your business accounts, it’s very likely those verification messages were generated by authentication attempts against that account.

It’s also worth noting that receiving a verification code doesn’t necessarily mean someone successfully accessed your account. It indicates that an authentication request reached the verification stage, but the sign-in would still require the correct verification code (or another approved authentication method) to complete.

If these prompts continue unexpectedly, I recommend changing the password for the affected account, reviewing your registered authentication methods, and, if possible, using Microsoft Authenticator or passkeys instead of SMS for stronger account protection.

For additional reference:

• Check recent Microsoft account activity
• Voice call authentication method - Microsoft Entra ID | Microsoft Learn

I hope this helps clarify why the SMS messages don’t identify the account and how you can determine which account generated them.