{"id":8732,"date":"2023-09-01T14:02:49","date_gmt":"2023-09-01T18:02:49","guid":{"rendered":"https:\/\/tcn.tidbits.com\/?p=10026"},"modified":"2023-09-01T15:44:11","modified_gmt":"2023-09-01T19:44:11","slug":"what-should-you-do-about-an-authentication-code-you-didnt-request","status":"publish","type":"post","link":"https:\/\/www.macworks.com\/blog\/what-should-you-do-about-an-authentication-code-you-didnt-request\/","title":{"rendered":"What Should You Do about an Authentication Code You DIDN\u2019T Request?"},"content":{"rendered":"

We strongly encourage using two-factor authentication (2FA) or two-step verification (2SV) with online accounts whenever possible. The details vary slightly, but with either one, after you enter your password, you must enter an authentication code to complete the login. Although it\u2019s always best to get such codes from an authentication app like 1Password<\/a> (which enters codes for you), Authy<\/a>, or Google Authenticator<\/a>, many websites still send codes by the less secure SMS text message or email. They\u2019re better than nothing.<\/p>\n

But what if you receive a 2FA code that you didn\u2019t request?<\/p>\n

    \n
  1. Don\u2019t panic. Although receiving the code means that someone is trying to log in to your account and has your password, the extra authentication step has done its job and protected your account from being compromised.<\/li>\n
  2. Never share an authentication code with anyone! A hacker could attempt to break into your account, be foiled by two-factor authentication, and then email or text you with a trumped-up story about why you should send them the code. Authentication codes are short-lived, so if this is going to happen, it will happen right away.<\/li>\n
  3. Independently from the message with the code, go to the account website, log in, and change the password. As always, make sure the password is strong, unique, and stored in your password manager. If the account used an old password that was shared with other accounts, change passwords on those accounts as well.<\/li>\n<\/ol>\n

    There are a handful of scenarios that could generate such an authentication code:<\/p>\n