Check whether the account is under recovery attack

A code is not proof of entry

An unexpected code can mean someone knows the username and started recovery; it does not always mean they entered the account. Security alerts and session history provide more context.

Prompt bombing

Repeated approval prompts are designed to wear you down. Deny them, stop the attempt through the provider's security controls and report suspicious access.

Change compromised dependencies

If the reset relies on email or SMS, secure those accounts too. An attacker controlling a recovery channel can undo a password change.

Upgrade authentication

Prefer phishing-resistant options such as security keys or passkeys when the provider supports them. Store recovery codes securely and separately from the device.

Read reset activity by severity

A code alone can be a failed attempt. An approved prompt, changed recovery method or unknown session shows a deeper problem.

  • Unexpected code only

    Do not share or approve it. Open the account directly and review security activity.

  • Repeated prompts or calls

    Protect the email and phone recovery routes and stop responding to anyone requesting the code.

  • Account change or unknown session

    Change the credential from a trusted device, revoke access and follow the provider's compromise process.

Judge the reset attempt by what changed

An unexpected code can mean an attempt failed. An approved prompt, unknown session or changed recovery method means the response should move beyond ignoring the message.

Code only
Do not share or approve the code. Open the account independently, review recent security activity and confirm the password and recovery details still belong to you.
Repeated pressure
Block contact from anyone requesting the code and protect the email and phone routes receiving resets. Repeated prompts may be designed to make one accidental approval more likely.
Access succeeded
If a new session, password change or recovery update appears, use the provider's official compromise process, revoke access and change credentials from a trusted device.
Cause check
Review whether the username, password or recovery data was exposed elsewhere. Replace reused passwords and inspect the primary email account before assuming the single targeted service is the only risk.

Preserve the original security alerts until the account is stable. A screenshot helps with quick notes, but the provider's security log and original messages may contain better timestamps and device details.

Do not approve an action you did not start

  1. Deny unexpected prompts and stop responding to anyone asking for a code.
  2. Inspect the account through its official app or typed web address.
  3. Secure the email and phone number used for recovery.

Record the reset-code pattern

  • Note which services sent codes, at what times and through which channel.
  • Record unfamiliar login alerts, recovery changes or sessions found on those accounts.
  • List the primary email, phone and password-manager protections strengthened in response.

Questions before trusting the warning

Can support ask me to read back the code?

Treat an unexpected request as hostile. Codes are for the sign-in or recovery flow you initiated, not for an inbound caller.

Should I click ‘cancel reset’ in the email?

Navigate to the account directly unless you have independently verified the provider's message and domain.

Follow the signal if it points elsewhere

If the recovery mailbox shows unfamiliar activity, follow the hacked-email recovery steps.

If text-message codes stopped arriving, investigate the SIM-swap warning signs.

General information only

Processes, rights and deadlines depend on your location, provider and policy. Use the relevant official service for your jurisdiction.

Primary sources