Is this a legit MFA message?

Joined
May 10, 2005
Messages
3,190
Location
Toronto, Canada
Screenshot 2026-05-17 153951.webp


I did not request a one time code, at least not in the last few days. Yet the sender address seems legit xxxxx. microsoft .com
 
If you didn't request it, I wouldn't try to use it. You might consider going into your microsoft account to determine if anyone else is trying to spoof you.

I don't talk to Microsoft, but usually these codes have a time expiration (30 Mins or less). This one implies it is good for a long time??
 
The email itself appears valid:
https://support.microsoft.com/en-us...unt-team-685fd302-f52f-1a9f-cc13-065dec46fe25

Most likely someone attempted to login with your credentials, which thanks to 2FA sent the code. Without that code, they can't successfully sign in.

You can delete the email, nothing "bad" has happened. If you are feeling extra inspired, you can login with your credentials and change your password. Its also a good time to verify all your account info is correct.
 
I did not request a one time code
It's nothing to worry about. Someone may have tried to login with your email address (this can be completely random too and not someone "targeting" you) but you have 2FA turned on, so it worked exactly like it's supposed to. If you want, and this really isn't necessary, you can change your password. I'd strongly suggest using your browser's option to generate a secure password and let it save it 'cause no one can memorize these passwords anyway !
 
do you know how to download the headers of the email? you can paste that into a chatbot and ask about the email's legitimacy

also: CHANGE YOUR PASSWORD RIGHT NOW

edit: also, if you use that same password anywhere else, you should change it there immediately also, hopefully not your bank info
 
also: CHANGE YOUR PASSWORD RIGHT NOW

Emphasis on this. They already have your password since they were able to get to the mfa selection. Also check the MFA security after changing your password to make sure the verification methods are correct and valid.
 
So I got the same email so I checked. The code is an alternative login to the password. So I can put in [email protected] and have it send you a login code without having to enter in a password.

Seems like a blanket attempt but still a good idea to login to MS directly and check the recent logins from there.
 
Back
Top Bottom