Microsoft Single Use Code Scam - How to Protect Yourself

Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Microsoft Single Use Code Scam - How to Protect Yourself

Unexpected Microsoft "single-use code" emails is a common scam or annoyance, often indicating attackers or bots are testing your account credentials or that someone mistyped their email. While the email itself may be legitimate from Microsoft, it signifies a security check, not a direct threat to your account unless you share the code.

What To Do

Do Not Share: Never provide the code to anyone, not even someone claiming to be from Microsoft.
Ignore Suspicious Emails: If you did not initiate a login, you can generally ignore these emails.
Check Recent Activity: Go directly to the Microsoft account activity page (type it into your browser, do not click links in the email) to check for authorized sign-ins.
Change Your Password: If you receive multiple emails, it's wise to change your Microsoft account password.
Enable 2FA/Go Passwordless: Increase security by enabling two-factor authentication or setting up the Microsoft Authenticator app to prevent unauthorized access.

Is it a Scam?

Genuine Alert vs. Phishing: These emails often come from @accountprotection.microsoft.com. If the email asks you to click a link to a non-Microsoft website, it is likely a phishing scam.
The Cause: Attackers may be "spraying" emails to see which ones are active or using "forgot username" options to trigger these notifications.

If you are worried, it is always safer to navigate to the official Microsoft security site directly rather than engaging with the email.