# I got a verification code I didn't request: what does it mean?

URL: https://iblockspam.com/blog/verification-code-i-didnt-request
Last updated: 2026-11-03
Published: 2026-11-03
Topic: Phishing & threats
Author: iBlockSpam Team

> Got a verification code you didn't request? Why it happens, the one thing never to do, how to check the account safely, and when it means your password leaked.

## Short answer

An unrequested verification code usually means someone typed your email or phone number into a sign-in or password-reset page, by mistake or on purpose. The code alone doesn't let them in. Don't share it, don't click links in the message, and don't approve any prompt. Open the account yourself, check recent activity, and change the password if anything looks wrong.

A text or email says "Your verification code is 482913", and you didn't ask for one. It's unsettling, but on its own it usually isn't a sign that someone is in your account. It means someone started a sign-in or password reset using your email address or phone number. This guide explains what each kind of unrequested code means, the one thing you must never do with it, and how to check your account without falling for the scam that often follows.

## What does it mean when I get a verification code I didn't request?

An unrequested verification code means a service was asked to prove that someone owns your email address or phone number, and that someone wasn't you. A verification code (also called a one-time passcode, OTP or security code) is a short number a service sends to confirm it's really you signing in, resetting a password or adding a device.

Microsoft lists three possible causes for an unexpected Microsoft code ([Microsoft Support](https://support.microsoft.com/en-us/account-billing/troubleshoot-microsoft-verification-code-issues-409090c4-92b5-42b9-8ae6-bcc97e62fc48)):

- "Someone is trying to access your account."
- "Someone accidentally entered the wrong phone/email when trying to sign in."
- "Delivery of the code you requested some time ago was delayed."

Google gives a similar list of reasons it may text you, including resetting a password when you can't get in, signing up for 2-Step Verification, creating an account, confirming it's really you when you sign in, and changes to your account ([Google Account Help](https://support.google.com/accounts/answer/3367674?hl=en)). For an unrequested text code, Google says: "You can disregard and delete the text code that you received", and adds: "Do not share any codes received with anyone."

### Is my account hacked if I got a code I didn't ask for?

Probably not. Microsoft says: "If someone is trying to access your account, without the code, your account is safe." The code is the lock, not the key. Someone triggering a code can't see it unless they control your inbox or phone, or you give it to them.

There's one important exception. Some codes only appear after the correct password has been entered. If you get an "approve sign-in?" push notification or a two-step verification code that comes after the password step, the person may already have your password. We cover how to tell the difference below.

## What are the common reasons for an unrequested code?

This table sums up what each situation usually looks like and what to do. Treat it as a guide, not proof: you confirm what really happened by checking the account itself.

| What you received | Most likely reason | What it says about your password | What to do |
|---|---|---|---|
| One code, then nothing | Someone mistyped their email or phone | Nothing | Ignore and delete it |
| A code you asked for hours ago | Delayed delivery | Nothing | Ignore it; request a fresh one if you need it |
| Several sign-in or reset codes in a row | Someone is trying to get in with a code or a reset | Not necessarily known | Check recent activity; consider passwordless sign-in |
| A two-step code after a sign-in you didn't start | Someone entered your password | Probably known | Change the password now |
| Repeated "approve sign-in?" push prompts | MFA fatigue (push bombing) | Probably known | Deny every prompt, change the password, tell IT |
| A code followed by a call, text or chat asking for it | A scammer is trying to take over the account | Possibly known | Never share it; hang up and check the account yourself |
| A Google Voice code while selling something online | Google Voice scam | Not needed by the scammer | Never share it; report it |
| Dozens of sign-up confirmations at once | Email bombing to hide an alert | Unknown | Search the flood for real security alerts |

## Why would someone ask me for my verification code?

Someone asks for your code because it's the last thing standing between them and your account. The Federal Trade Commission is blunt about this: "Never give your verification code to someone else," and "Anyone who asks you for your account verification code is a scammer" ([FTC, March 2024](https://consumer.ftc.gov/consumer-alerts/2024/03/whats-verification-code-why-would-someone-ask-me-it)).

The approach usually comes seconds after the code arrives, so the two feel connected. Common versions:

1. **Fake fraud department.** A caller says your bank account or email has been hacked and they need to "verify" you. They trigger a real code, then ask you to read it out. The FTC says to hang up and call your bank on a number you trust, such as the one on your statement or app.
2. **"Sorry, I typed your number by mistake."** A text from a stranger says they entered your number while signing up and asks you to forward the code. Whatever account it opens, it isn't theirs.
3. **The online marketplace "buyer."** In the [Google Voice scam](https://consumer.ftc.gov/consumer-alerts/2021/10/google-voice-scam-how-verification-code-scam-works-how-avoid-it), someone answering your listing says they want to check you're real, texts you a Google Voice code and asks for it back. With it, the FTC explains, they set up a Google Voice number tied to your phone number. The FTC's verdict on any code request from someone you didn't contact first: "That's a scam, every time."
4. **Fake IT help desk.** At work, a caller or a Teams chat from "IT support" asks for a code or a prompt approval to "fix" your account. See our guide to [fake help desk chats in Microsoft Teams](https://iblockspam.com/blog/microsoft-teams-phishing-external-access).

Phone and text versions of these scams are known as vishing and smishing; our guide to [phishing vs smishing vs vishing](https://iblockspam.com/blog/phishing-vs-smishing-vs-vishing) explains how attackers chain an email, a text and a call together.

### Example of a code request scam

This is an **example** written for this guide. It is not a real message from any company.

```
Text from +1 (555) 013-2291, 10:42
Hi, this is Dana from the account security team. We've
detected a login attempt on your email from another state.
To block it, we just sent you a 6-digit code. Please reply
with that code so we can verify you're the real owner.
```

A real security team never needs your code. The code was sent because the scammer is signing in as you right now, and the code is what they're missing.

## Is a verification code email ever a phishing email?

Yes. Some phishing emails copy the look of a code notification, then add a line such as "Didn't request this? Secure your account" with a link to a fake sign-in page. The code in them is meaningless; the link is the trap. Microsoft says "Valid verification codes come from an @accountprotection.microsoft.com email address." If you're unsure whether a message is genuine, don't click any link in it; go to account.microsoft.com yourself.

Sender addresses can be faked or misread, so don't rely on them alone. Our guides to [Microsoft unusual sign-in activity emails](https://iblockspam.com/blog/fake-microsoft-unusual-sign-in-activity-email) and [fake Google security alerts](https://iblockspam.com/blog/fake-google-account-security-alert-phishing) show what the genuine and fake versions look like. If you want to see where a code email really came from, paste its headers into the free [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer), which runs in your browser.

## What should I do right now?

Use this checklist when an unrequested code arrives. It takes about five minutes.

1. **Don't share the code.** Not by text, phone, email or chat, and not with anyone claiming to be the company itself.
2. **Don't click anything in the message.** Don't call numbers in it either.
3. **Deny any sign-in prompt.** On a Google "Trying to sign in?" prompt, Google says to tap **No, don't allow** ([Google Account Help](https://support.google.com/accounts/answer/7026266?hl=en)). In Microsoft Authenticator, deny or report the request.
4. **Open the account yourself.** Type the address into the browser or use the official app.
5. **Check recent activity.** For a Microsoft account, the [Recent activity page](https://support.microsoft.com/en-us/accounts-billing/security/what-is-the-recent-activity-page) shows "when and where you've used your Microsoft account within the last 30 days", and failed attempts appear as "Incorrect password entered". For Google, review sign-in activity from the Security section of your Google Account.
6. **Change the password if anything looks wrong,** or if the code came after a password step. Use a new, unique password.
7. **Check recovery details and forwarding.** Make sure the recovery phone, recovery email and any mail forwarding are yours. [Signs your email account is compromised](https://iblockspam.com/blog/signs-email-account-compromised) lists what to look for.
8. **Report it.** Report scam texts or calls at ReportFraud.ftc.gov, and phishing emails with your mail app's report button. See [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email).

## How do I tell if someone has my password?

The type of code tells you a lot. A code sent to sign in without a password, or to reset a forgotten password, can be triggered by anyone who knows your email address or phone number. That's why a single unexpected code isn't evidence of a leak.

A second-step code or push prompt is different. In most services it appears only after the first factor, the password, has been accepted. CISA makes this point for push notifications: "MFA checks are done after the first factor (e.g., the user's password) is satisfied, so denied MFA requests could mean the user's password is compromised" ([CISA, October 2022](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf)).

### What is MFA fatigue?

MFA fatigue is a flood of sign-in approval requests sent to wear you down. CISA defines it: "MFA fatigue, also known as 'push bombing,' occurs when a cyber threat actor bombards a user with mobile application push notifications until the user either approves the request by accident or out of annoyance with the nonstop notifications." Number matching, where you must type a number shown on the sign-in screen into the app, stops a blind approval because you can't see the attacker's screen.

If prompts keep coming, deny each one, change your password from a trusted device and, at work, tell IT straight away. An attacker who already has your password may also try a fake sign-in page that relays your code in real time; our guide to [adversary-in-the-middle phishing](https://iblockspam.com/blog/adversary-in-the-middle-phishing-mfa-bypass) explains how that works.

## How do I stop getting verification codes I didn't request?

You can't stop other people typing your email address into a sign-in box, but you can make those attempts useless and quieter.

- **Go passwordless where offered.** Microsoft says that to "stop getting codes you didn't request, you can go 'passwordless' on your Microsoft account", meaning you remove the password and sign in with the Authenticator app, Windows Hello or a security key.
- **Switch to passkeys or security keys.** These are tied to the real website, so a code can't be phished from you. See [passkeys and phishing-resistant MFA](https://iblockspam.com/blog/passkeys-phishing-resistant-mfa-email).
- **Prefer app prompts with number matching over SMS.** Text codes can be redirected if someone takes over your phone number, which our guide to [whether someone can hack your email without your password](https://iblockspam.com/blog/can-someone-hack-my-email-without-my-password) covers.
- **Use a unique password for each account.** If your address appeared in a breach, someone may be testing the old password; see [what to do if your email is in a data breach](https://iblockspam.com/blog/what-to-do-if-your-email-is-in-a-data-breach).

If the codes arrive alongside hundreds of sign-up emails, you're probably being email bombed to hide a real alert. Our [email bombing guide](https://iblockspam.com/blog/email-bombing-subscription-bombing) explains what to search for in the flood.

## What should IT admins do when staff report unexpected codes?

Treat a report of an unexpected second-step prompt as a possible password compromise, not a nuisance. CISA recommends that when a user denies an MFA request, they "alert their IT security team, who should investigate the root cause."

1. **Turn on Report suspicious activity in Microsoft Entra.** In the Microsoft Entra admin center, go to **Entra ID** > **Authentication methods** > **Settings** and set **Report suspicious activity** to **Enabled**. Microsoft notes the feature stays disabled if left on **Microsoft managed** ([Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings)). Users who report a prompt are set to **High User Risk**, and the event appears in the risk detections report and sign-in logs.
2. **Check the sign-in logs** for the user: failed and successful sign-ins, locations and devices around the time of the prompt.
3. **Reset the password and revoke sessions** if the prompt followed a correct password. Our guides to [Microsoft 365 compromised account remediation](https://iblockspam.com/blog/microsoft-365-compromised-account-remediation) and [Google Workspace compromised account recovery](https://iblockspam.com/blog/google-workspace-compromised-account-recovery) give the full order.
4. **Move people off SMS and simple push.** Number matching is an interim step; CISA strongly encourages phishing-resistant MFA. See [Microsoft 365 security defaults and MFA](https://iblockspam.com/blog/microsoft-365-security-defaults-mfa).
5. **Write the rule into training:** nobody from IT will ever ask for a code or an approval. Our [security awareness training guide](https://iblockspam.com/blog/email-security-awareness-training-small-business) has more points to cover.

Many code-request scams start with a phishing email that collects the password first. Filtering that mail before it reaches inboxes removes the first step, which is the job of an MX-level filter in front of Microsoft 365 or Google Workspace; see [how iBlockSpam works](https://iblockspam.com/how-it-works).

## Next steps

1. Save the rule somewhere visible: a verification code is for you to type, never for anyone to hear.
2. Check recent activity on your main email account today, and switch it to a passkey or passwordless sign-in.
3. If you run IT, turn on Report suspicious activity and tell staff to report every unexpected prompt.
4. Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your domain, and see [iBlockSpam for small business](https://iblockspam.com/solutions/small-business) if phishing keeps reaching your team.

## Frequently asked questions

### Can someone hack my account with just a verification code sent to me?

Not with the code sitting in your inbox or texts. The code only helps an attacker if you hand it over, type it into a fake page, or approve a prompt. Microsoft says that if someone is trying to access your account, without the code, your account is safe. The risk is a scammer who contacts you next and asks you to read the code out.

### Why do I keep getting Microsoft single-use codes I didn't ask for?

Microsoft lists three causes: someone is trying to access your account, someone entered the wrong phone or email by mistake, or a code you requested earlier arrived late. Repeated codes usually mean someone keeps trying to sign in with a code instead of a password. Microsoft says going passwordless on your Microsoft account stops codes you didn't request.

### Should I reply STOP or report a verification text I didn't request?

Don't reply to the text at all, and don't tap any link in it. If it came from a short code the service really uses, you can simply delete it, as Google advises for its own unrequested codes. If the message asks you to call, click or send the code anywhere, treat it as smishing and report it through your phone's spam reporting option.

### Is a verification code email from a real company address always safe?

The email itself can be genuine and still be part of an attack, because the real service sent it after someone else typed your address. The danger is what happens next: a call, text or email asking for the code. Microsoft says valid codes come from an @accountprotection.microsoft.com address, but no company will ever need you to pass a code to another person.

### What should I do if I already gave someone my verification code?

Act straight away. Sign in to the real account by typing its address, change the password, sign out of other sessions and check recovery details and two-step settings. If it was a Google Voice code, follow Google's steps to reclaim your number. For a bank code, call the number on your card or statement. Report the scam at ReportFraud.ftc.gov.

## Sources

- [Microsoft Support: Troubleshoot Microsoft verification code issues](https://support.microsoft.com/en-us/account-billing/troubleshoot-microsoft-verification-code-issues-409090c4-92b5-42b9-8ae6-bcc97e62fc48)
- [Microsoft Support: What is the Recent activity page?](https://support.microsoft.com/en-us/accounts-billing/security/what-is-the-recent-activity-page)
- [Google Account Help: When Google might send you a text](https://support.google.com/accounts/answer/3367674?hl=en)
- [Google Account Help: Sign in with Google prompts](https://support.google.com/accounts/answer/7026266?hl=en)
- [FTC Consumer Advice: What's a verification code and why would someone ask me for it? (March 2024)](https://consumer.ftc.gov/consumer-alerts/2024/03/whats-verification-code-why-would-someone-ask-me-it)
- [FTC Consumer Advice: The Google Voice scam (October 2021)](https://consumer.ftc.gov/consumer-alerts/2021/10/google-voice-scam-how-verification-code-scam-works-how-avoid-it)
- [CISA: Implementing Number Matching in MFA Applications (October 2022)](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf)
- [Microsoft Learn: Configure Microsoft Entra multifactor authentication (Report suspicious activity)](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/verification-code-i-didnt-request (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt