Account-code requests · Account guidance
An account code arrives. Then someone asks for it.
A real code can arrive without you requesting it. A later caller might offer to explain or cancel it. The code's arrival does not establish that person's authority.
By Olevo · Reviewed
The detail to carry with you
Keep the code private and unused. Check the account through Microsoft's own site; an incoming caller or reply thread does not need the code to let you do that.
From published guidance
What the guidance establishes
FTC warning published: by Federal Trade Commission.
Scope and timing: Provider and consumer guidance, not an individual incident. Provider-specific comparison checked November 3, 2026; the FTC warning dates from March 2024.
Microsoft's personal-account guidance gives several explanations for an unrequested code, including an access attempt, a mistyped address and delayed delivery. An unexpected email alone does not establish that someone successfully signed in.
Separately, the FTC's March 2024 warning describes impersonators asking people to share verification codes. We bring these sources together to examine a possible sequence, rather than claim they document the same incident.
A closer reading · Analysis
The code and the caller are different evidence
An account service can send a genuine code while an unrelated person misrepresents what you should do with it. A caller knowing that a code arrived is not enough to establish that they work for the provider.
Ask what sharing the code would authorize. You do not need to resolve that with the caller: stop the conversation and use your existing account route to check activity. Keep working codes out of screenshots sent to other people or review tools.
Check activity before drawing a conclusion
A code notification is a prompt to consider the account context. It is not a complete account history. If you can still sign in, inspect security activity through Microsoft's own site. If access is lost or activity is unfamiliar, follow its security and recovery process.
For a work or school account, contact your organization's IT team through an established route. Personal-account advice does not describe every organization's sign-in setup.
Visa: checkout or enrolment is not a payment record
Visa documents genuine Click to Pay enrolment and checkout. Ask which process you started and check the issuing bank's actual card activity. An email about enrolment does not establish that money moved, and a later caller still needs an independent identity check.
If the caller says a code will cancel a charge, stop there and ask the bank through its own support route. Do not turn a payment claim into permission to disclose account-access information.
Link: an unexpected code has more than one explanation
Link's help describes verification on new sites or devices, remembered devices and possible mistyped numbers. Those possibilities explain why the notification alone is insufficient to diagnose an account takeover. Review the actual account and card records rather than replying with the code.
The useful comparison with Visa is the separation between an identity check and a completed purchase. Neither service name makes an incoming person's instructions authoritative.
O2: an account code is not a discount voucher
O2 warns that it will not call, text or email asking for a one-time code, password or account-security information. Its authorisation-code guidance describes callers using discount offers to obtain access codes. Check an offer in My O2 or through independently reached support instead.
The four providers do not have interchangeable account procedures. What transfers across these examples is the question: am I completing a task I initiated through the real service, or giving another person a private code? Keep the provider-specific recovery process when the code has already been disclosed.
Before reading the code back
End the incoming conversation. Open the account yourself. The person asking for the code does not need to supervise an independent security check.
Three questions to keep nearby
- Did I start this sign-in or recovery action?
- Am I being asked to give a private code to another person?
- What does the account's own activity page show?
If something similar has happened
If the code remains private, leave it unused and check the account independently. If you shared it or lost access, use the provider's official account-security process promptly. Contact the organization's IT team for a work or school account.
Sources and scope
Sources checked November 3, 2026. We summarize the public record and label our own analysis. The reporting organization has not endorsed Olevo.
See a factual error or a broken source? Send a correction.
Common questions
Can a genuine code be involved in a scam request?
Yes. A real provider can generate a code while another person asks you to disclose it under a misleading explanation. Keep the code private and verify account activity yourself. The code's arrival does not prove that an incoming caller or message represents the provider.
Does an unexpected Microsoft code prove someone has my password?
No. Microsoft describes several possible reasons for unrequested codes. Use the account's own security activity and recovery tools to understand what happened. If you notice unfamiliar activity, shared a code or cannot sign in, follow the official security process rather than an incoming caller's instructions.