Why Do I Keep Receiving Microsoft Authenticator Codes?
If you keep receiving Microsoft Authenticator codes you did not ask for, the most likely explanation is that someone has your password and is trying to sign in, and the code is the only thing stopping them. The second most likely explanation is a device or app of your own trying to reconnect. Either way the first move is the same: do not approve anything, and change the password from a device you trust. This article, first published in 2025 and updated in September 2026, explains what the codes mean, how to tell the difference, and what to do in the next ten minutes.
Your account has been compromised
Microsoft sends a verification code, or a push prompt, when someone enters your username and password correctly. If that someone was not you, your password is in the wrong hands. Passwords leak constantly: through phishing pages that look like a Microsoft sign-in, through infostealer malware on a home computer, and through the enormous collections of stolen logins that circulate among criminals. The large compilations reported in the press in 2025 were mostly records of that kind, which is why a password you have used for years on several sites is the one most likely to be tried against your work account.
What to do next
- Do not approve the prompt and do not enter the code anywhere. A code typed into a page or read out over the phone is the attacker’s way past the second step.
- Change the password from a device you trust. Use one you have never used elsewhere. Our guide to creating a secure password covers what works in 2026: long, unique, and stored in a password manager.
- Sign out everywhere and review the sign-in log. Microsoft account and Microsoft 365 security pages both list recent sign-ins with location and device. Remove anything you do not recognize.
- Check for changes the attacker may have made. A forwarding rule on your mailbox, a new recovery phone number, or an added authentication method are the common ones, and they survive a password change unless you remove them.
- Change the password on any other account that shared it. Attackers try the same password on banking, email and cloud storage within minutes.
Phishing or MFA fatigue
Some attackers send prompt after prompt, at any hour, hoping you will approve one to make the phone stop. This is called MFA fatigue or push bombing, and it works often enough that Microsoft added number matching, which asks you to type a number shown on the sign-in screen so a prompt cannot be approved by reflex. Turn it on. If your business uses Microsoft 365, your administrator can require it for everyone. If you do not have one, our Microsoft 365 support team can review your sign-in security for you.
What to do next
- Never approve a prompt you did not start, no matter how many arrive.
- Report it to your IT team and, for a personal account, to Microsoft through the account security page.
- Change the password. The prompts stop when the password no longer works.
A recent sign-in on a new device
Not every unexpected code is an attack. A new phone, a reinstalled Outlook or Teams, a browser that cleared its cookies, a shared mailbox that re-authenticates on a schedule, or a colleague setting up a conference-room PC with your account can all trigger one. The tell is timing. If the code arrives while you are at your desk doing something with the account, it was probably you. If it arrives at 3 a.m. or while your phone is in your pocket, it was not.
What to do next
- Look at the sign-in log for the device and location the request came from.
- Remove any device or app you do not recognize, then change the password anyway if you are unsure.
How to make the codes stop for good
Codes and prompts are the fallback layer. The stronger options remove the password from the attack entirely. A passkey, which Microsoft supports on personal and work accounts, signs you in with your phone or computer’s own lock screen and cannot be phished or replayed. A hardware security key does the same for people who prefer a physical device. For a business, setting up multi-factor authentication properly, with number matching, sign-in risk policies and a review of who still has legacy authentication enabled, is a two-hour job that removes the most common way small companies get breached. Our explainer on multi-factor authentication covers the options.
When to call someone
Unexpected codes on a work account are a security incident, not an annoyance. Under a managed plan the provider can see the attempts in the sign-in logs, block the source, revoke every active session and confirm that nothing was changed on the mailbox. If you believe an account has been compromised, our cybersecurity team handles this every week; if a login succeeded and data may have been reached, our breach response plan walks through what happens next. A free consultation is a phone call away: ask for Adam at 952-548-5558.
Free tools from OAC Technology
- Managed services pricing calculator: a monthly figure for managed IT, in about a minute
- How much managed IT services cost: our published per-device rates and three worked examples
- What to expect as a client: how onboarding works, week by week
Common questions
Does an unexpected Authenticator code mean I have been hacked?
It means someone entered your correct username and password somewhere, or an old session on a device you own is trying to reconnect. If you were not signing in at that moment, treat the password as known to someone else and change it. The code itself protects you; the account is only compromised if you approve the prompt or share the code.
What should I do in the first ten minutes?
Do not approve the prompt or type the code anywhere. Change the password from a device you trust, sign out of all sessions from the account security page, review recent sign-in activity, and remove any device you do not recognize. Then check any other account that used the same password.
Why do the prompts keep coming?
Because the attacker keeps trying, hoping you will approve one out of habit or annoyance. Once the password is changed the attempts stop, since the password no longer gets them to the second step.
How do I stop getting codes I did not ask for?
Change the password, turn on number matching in Authenticator so a prompt cannot be approved by accident, and consider a passkey or a hardware security key for the account, which cannot be triggered by someone who only has your password.
Could it be me, not an attacker?
Sometimes. A new phone, a reinstalled mail app, a browser that cleared its cookies, or a shared mailbox that re-authenticates can all trigger a code. If the timing matches something you did, it was probably you. If it arrives while you are asleep or away from your devices, it was not.
Should I tell my IT provider?
Yes, the same day. Under a managed plan they can see the sign-in attempts, block the source, force a sign-out across every device and confirm nothing else on the account was changed, such as a forwarding rule that quietly sends copies of your email elsewhere.
Talk to us
Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
