Email hack?

[tight fart]

I keep getting a Microsoft email (daily) with a single use code.

“We received your request for a single-use code to use with your Microsoft account.”

I’m not requesting it, it says,

“If you didn't request this code, you can safely ignore this email. Someone else might have typed your email address by mistake”

But now I’m starting to think someone wants to steal,hack?
My email address, anything I can do to stop it or secure it better?

[Muppet007]

Change your password for accounts that use that email.

The code is the 2nd part of two step verification.
1st step is typing in your password correctly for that email address.

Edit to add, thinking about it more, they might be trying to reset your password, rather than already have it.

Edited by Muppet007 on Tuesday 22 February 08:23

[e-honda]

Sounds fake, typically companies don't tell you to ignore any more, that was a bad practice.

What happens when you login normally? Do you have the option to get your 2fa code sent via email?

[RichTT]

Is it actually from Microsoft? It's highly likely this could be a phishing attempt. Make sure you don't click on any links in the email and if it's not actually from MS then block the sender or report as spam / phishing.

If it is from MS then it might be someone attempting to brute force the password to your MS account but less likely.

As long as your password is secure then I would just block the sender if their not really MS and move on.

[Freakuk]

I've had the same for the last 2 days, I'm just ignoring them if I am honest.

I have MFA setup (like you) and whoever is trying to hack my account needs the code I am receiving so I'm not too worried.

I may change my hotmail password though, even if it's just to stop receiving the alerts.

EDIT - Just checked, and when I enter my email address on hotmails front page, it immediately sends me a code to my other email account, I don't need to enter my password at any stage, just the code received on my other account.

Edited by Freakuk on Tuesday 22 February 09:02

[tight fart]

Thanks, I believe it's genuine from Microsoft, there aren't any links to follow.

[e-honda]

That is a poor show from Microsoft
Unless they do some risk scoring and determine that you really can safely ignore it, and send something different in other cases

[Djw John]

I've been getting the same, the lack of link to another site makes me think its genuine but I wonder if someone is targeting a whole list of email addresses and we're getting these emails as a result.

Unless they get into my other email account I don't see how they would get round it. But I'm very much not an expert

[Sheepshanks]

e-honda said:

That is a poor show from Microsoft
Unless they do some risk scoring and determine that you really can safely ignore it, and send something different in other cases

What are users supposed to do - the only thing needed to request a code is the email address?

I get a fair number of them on an old Hotmail account that's just initialsurname - I guess it's people hoping they can get that email address, or thinking they do already have it. It's been used by people to sign up to all sorts of stuff - for years I've been getting a Canadian's broadband bill and an American's medical insurance payments.

Even if it is hackers, and they're going to try and brute force in using passcodes, what could you do about it?

[e-honda]

Sheepshanks said:

What are users supposed to do - the only thing needed to request a code is the email address?

I get a fair number of them on an old Hotmail account that's just initialsurname - I guess it's people hoping they can get that email address, or thinking they do already have it. It's been used by people to sign up to all sorts of stuff - for years I've been getting a Canadian's broadband bill and an American's medical insurance payments.

Even if it is hackers, and they're going to try and brute force in using passcodes, what could you do about it?

They need to keep aware of what is going on
If you get them occasionally it maybe ok to ignore, If one day they keep piling in then that suggests someone is making a determined effort to get in to your specific account, you take different action.
If Microsoft keeps telling you it's safe to ignore on each one then that is not good.

[buggalugs]

CheesecakeRunner said:

Both email and password are usually needed to get the code to login. Email is just needed to get the code in a password reset scenario.

That has changed recently, in some situations now you can choose to log in via a one time code they email to you, no password required.

[Sheepshanks]

CheesecakeRunner said:

buggalugs said:

CheesecakeRunner said:

Both email and password are usually needed to get the code to login. Email is just needed to get the code in a password reset scenario.

That has changed recently, in some situations now you can choose to log in via a one time code they email to you, no password required.

Yes, that’s why I wrote “usually”. Passwordless login is still quite rare, although I have implemented it for a couple of clients.

Sorry if I'm missing something here, but the OP is asking about his Microsoft personal account - if you forget the password it'll email or text you a one time code. That's the whole point of it - user has forgotten their password.

[anonymous-user]

Do you use the same email and password combo on other sites? If so it might have been exposed in a data breach, and people are now trying to access your email with the same credentials. As others have said, if you have MFA enabled you would usually only receive a code if someone had already provided the valid username and password.

Stick your email address in https://haveibeenpwned.com and see if its been part of any data breaches, and note if any of those included passwords being stolen too.