Phishing, recovery and stronger sign-in
Got a Verification Code You Didn't Request? What It Means
A stray code is usually someone else's typo, but what it means depends on the kind of code. A decision table by type, with the action for each from the provider's own page.
A stray code usually means someone typed your email address or phone number by mistake: Google, Shop, Stripe and WhatsApp all name that as the likely cause, and Microsoft lists it next to a real sign-in attempt. Without the code, whoever asked for it cannot finish; do not share it, and do not type it anywhere yourself. What changes the answer is the kind of code. A code that is the entire sign-in, with no password, is itself the key to the account, so guard it like a password. A code that arrives as a second step after a password can mean someone already has that password, so it is worth a closer look. A code from a checkout wallet usually means a stranger mistyped a phone number at checkout. And if a person contacts you and asks you to read a code back to them, the FTC's rule is short: that is a scam, every time.
Which kind of code did you get?
Match what the message says to a row, then do what that row says. The sources, checked September 28, 2026, are in the Claim ledger.
| What the message says | What it tells you | What to do now |
|---|---|---|
| A one-time sign-in code that is the whole login, with no password asked for | Someone entered your email or phone number at a sign-in page, and whoever has this code can sign in with it. Microsoft's page on unrequested codes covers all its verification codes and lists three causes: someone trying to get in, someone who typed the wrong email or phone, or a late copy of a code you asked for earlier | Do not share it or type it anywhere. Microsoft: "without the code, your account is safe." To be sure, look at the account's recent activity. |
| A code that arrived as a second step, after a password | Google lists 2-Step Verification among the reasons it texts a code, and says to disregard one you did not request. It does not prove a breach, but reaching the second step usually takes the password | Delete the code and do not share it. As a precaution, change that account's password from the account's own settings and run a security checkup. |
| A "reset your password" code or link you did not ask for | Someone started a reset with your email or phone number. Google lists password resets among the reasons it texts a code | Do not use the code or click the link. Your password has not changed. If resets keep coming, change the password from the account's own settings, not from the message. |
| A "confirm your email" or new-account message you did not start | For its own verification email, Google says it is likely that another user typed your address by mistake while recovering their own account. Other services do not all publish a cause | Ignore it and do not click its link. For Google, the account won't be verified; Google adds that if you already clicked, you need to reset that account's password to use or delete it. |
| A Shop, Link or similar checkout-wallet code for a purchase you didn't make | Shop's opt-out page: "Most likely someone typed your phone number by mistake." Link's page says the likely reason is that you are remembered on a device where you used Link before; Stripe's page adds that if you never entered your number, "it is likely that someone else entered their own number incorrectly" | Do not share the code. If the codes keep coming, see how to make them stop, below. |
| Someone calls, texts or messages you and asks you to read a code back to them | The FTC: if you did not contact them first, it is a scam every time, whatever the story. Its example is a "buyer" for something you listed for sale, or someone who says they found your lost pet, who wants to "verify" you | Do not share the code, whatever the explanation. Stop responding. Report it at ReportFraud.ftc.gov. |
| A WhatsApp registration code you did not request | WhatsApp says someone entered your phone number and asked for the registration code. This often happens by mistake, and it can also be an attempt to take over your account | Do not share the code. Without it, WhatsApp says, whoever is trying "can't use your phone number on WhatsApp." |
If you cannot tell whether the code was the whole sign-in or a second step after a password, follow the second-step row: a password change costs little and rules out the worse case. For a provider not listed here, the same logic holds: if nobody enters the code or opens the link, the attempt that sent it cannot finish.
Does an unrequested code mean my password is known?
It depends on where the code sits in the sign-in.
- Microsoft's page does not split codes by type. Its advice covers any Microsoft code you did not request: "Do not respond to any codes that you did not request. If someone is trying to access your account, without the code, your account is safe." A code that is the whole sign-in deserves the same care as a password.
- If the code is a second step after a password, an unrequested one says more, because reaching that step normally takes the password. The FTC describes the two locks this way: "If you know the account password but not the verification code, you can't get in." Google does not say that an unrequested 2-Step Verification text proves your password is known, and neither does this page. Changing the password and checking recent activity is a cheap precaution.
- Checkout-wallet codes (Shop, Link) come at checkout without any password, so they say nothing about your passwords.
How do you check whether anyone got in?
Go to the account directly, not through a link in the message.
- Google: Google's page on unrequested text codes ends: "For personalized recommendations and guidance to keep your Google Account safe, take a regular Security Checkup." Open it from the Security page of your Google Account.
- Microsoft: the Recent activity page "shows you when and where you've used your Microsoft account within the last 30 days", with the location and how the account was accessed for each entry. If something looks wrong, Microsoft sends you to the account's security settings to change the password.
- Shop and Link: neither page ties an unrequested code to a break-in. If you use the service, review your recent orders or Link activity in its own account pages.
When is it more than a one-off mistake?
A single stray code is ordinary. Two patterns deserve more attention:
- Repeated sign-in or reset codes for the same account. One typo is common; a run of them for one account looks like someone trying and failing. Repeated checkout-wallet codes are a different case: see how to make them stop, below.
- A code together with a "new sign-in" or "new device" alert you did not expect. Together they say more than either alone.
In either case, sign in to the account directly, check its recent activity, then change the password.
How do you make the codes stop?
- Microsoft: its page says "To secure your account further, and stop getting codes you didn't request, you can go "passwordless" on your Microsoft account", using a method such as Windows Hello, the Microsoft Authenticator app or a security key.
- Shop: the phone opt-out page stops Shop Pay codes to your number. It also deletes your phone number and any data tied to it, so skip it if you use Shop Pay with that number.
- Link: Link's page suggests logging out of Link on all devices.
- WhatsApp: its page points to two-step verification for more protection.
- Any other account you own: no provider can stop a stranger from typing your address, but a stronger sign-in means a leaked password is not enough. See what to set up before you switch to an authenticator app.
Is this message itself real, or could it be a fake?
This page assumes the message is genuine: a real code from a real provider that you did not ask for. If you are not sure it comes from who it claims to be, one-time code phishing: how to spot a fake verification email covers sender, link and wording checks.
Where does MagicLess fit?
MagicLess works on your side of the same rule: a code is only used on a sign-in page you opened. It wakes only on a page that looks like a login or verification step, offers only codes from Gmail mail that arrived in the last 15 minutes, and fills one only when you press Fill; it never submits a form. It does not know which codes you asked for: if you open that same service's login page soon after a stray code arrives, it can offer that code, so fill only a code you just requested. It reads Gmail, not text messages.
FAQ
Should I ever reply to or forward a verification code?
No. Google says to "disregard and delete" an unrequested text code and not to share codes with anyone, and the FTC says anyone who asks you for your account verification code is a scammer.
Does one unrequested code mean my account is already hacked?
Not by itself. Microsoft's wording is that without the code, the account is safe. A pattern (repeated sign-in or reset codes, an unexpected new-device alert) is a stronger signal than one code; see "When is it more than a one-off mistake?" above.
What if I already typed the code somewhere or read it to someone?
Act now: sign in to the account directly, change the password, and review recent activity; if Microsoft lists an entry under Unusual activity, choose "This wasn't me", otherwise go to Security settings and change the password. For a Google Voice code, the FTC points to Google's steps to reclaim your number.
Is it safe to just ignore these messages?
For a single stray code, yes: no reply, no click, no code entry needed. If the code came after a password step, also take the precautions in that row of the table.
Claim ledger
| Claim | Source | Last checked | Confidence |
|---|---|---|---|
| An unrequested Microsoft code could mean someone is trying to access the account, someone typed the wrong phone or email, or a delayed delivery; "Do not respond to any codes that you did not request. If someone is trying to access your account, without the code, your account is safe."; "To secure your account further, and stop getting codes you didn't request, you can go "passwordless"". | Microsoft Support: Troubleshoot Microsoft verification code issues | 2026-09-28 | High |
| The Recent activity page "shows you when and where you've used your Microsoft account within the last 30 days"; entries show location and how the account was accessed; the "This wasn't me" option is in the Unusual activity section. | Microsoft Support: What is the Recent activity page? | 2026-09-28 | High |
| For an unrequested text code: "You can disregard and delete the text code that you received. Do not share any codes received with anyone."; reasons Google texts include password reset, 2-Step Verification, account creation, unusual sign-ins and account changes; "For personalized recommendations and guidance to keep your Google Account safe, take a regular Security Checkup." | Google Account Help: When Google might send you a text message | 2026-09-28 | High |
| An unrequested "Google email verification" message is likely another user entering your email while recovering their own account; if you didn't start it, the account won't be verified; if you clicked the link, reset the password to use or delete that account. | Google Account Help: 'Google email verification' message | 2026-09-28 | High |
| "Most likely someone typed your phone number by mistake."; opting out stops Shop Pay verification codes and deletes your phone number and any data associated with it. | Shop: Opt out of Shop Pay | 2026-09-28 | High |
| Link: "it is likely that you are being remembered on another device in which you have used Link before"; "You can take precautions by logging out of Link on all devices." | Link Support: Why did I receive an email/SMS when I don't have a Link account? | 2026-09-28 | High |
| Stripe: "You received this text message because you saved your phone number for future purchases using Link"; otherwise "it is likely that someone else entered their own number incorrectly." | Stripe Support: Received "Your Stripe verification code is" text message from Stripe | 2026-09-28 | High |
| "don't share your Google Voice verification code — or any verification code — with someone if you didn't contact them first. That's a scam, every time."; the scam targets sellers and people looking for a lost pet; the FTC links Google's steps to reclaim a number. | FTC: The Google Voice scam: How this verification code scam works and how to avoid it | 2026-09-28 | High |
| "If you know the account password but not the verification code, you can't get in."; "Anyone who asks you for your account verification code is a scammer." | FTC: What's a verification code and why would someone ask me for it? | 2026-09-28 | High |
| An unrequested registration code means someone entered your number, often by mistake, and it can also be a takeover attempt; without the code they "can't use your phone number on WhatsApp"; two-step verification adds protection. | WhatsApp Help Center: Received verification code without requesting it | 2026-09-28 | High |
Sources
- Microsoft Support: Troubleshoot Microsoft verification code issues
- Microsoft Support: What is the Recent activity page?
- Google Account Help: When Google might send you a text message
- Google Account Help: 'Google email verification' message
- Shop: Opt out of Shop Pay
- Link Support: Why did I receive an email/SMS when I don't have a Link account?
- Stripe Support: Received "Your Stripe verification code is" text message from Stripe
- FTC Consumer Advice: The Google Voice scam: How this verification code scam works and how to avoid it
- FTC Consumer Advice: What's a verification code and why would someone ask me for it?
- WhatsApp Help Center: Received verification code without requesting it