Got one of these myself yesterday. Lots of people are waking up to @Microsoft password reset codes they never asked for, some several an hour. What I'd do:
Don't enter the code anywhere or read it to anyone who calls.
Sign in yourself at account.microsoft.com, never through activity and flag anything you don't recognize.
Add an authenticator app or passkey.
Under Your info, Sign-in preferences, uncheck any alias that doesn't need to sign in.
An unrequested code means someone has your email address and is hoping you'll supply the rest.
Don't enter the code anywhere or read it to anyone who calls.
Sign in yourself at account.microsoft.com, never through activity and flag anything you don't recognize.
Add an authenticator app or passkey.
Under Your info, Sign-in preferences, uncheck any alias that doesn't need to sign in.
An unrequested code means someone has your email address and is hoping you'll supply the rest.
21
27
150
25,080
@c7five @Microsoft Got half a dozen yesterday. Normally I wouldn't be concerned, but after the Lenovo email I got in August was actually an SSO exploit used to compromise my Dropbox account... now I find these a bit more unnerving.
Oct 23, 2026 · 12:07 PM UTC
7
1
27
2,831
@lopp @c7five @Microsoft My favorite are the 2FA push notifications anyone can send to your phone if they have nothing more than your Gmail address.
The Microsoft thing was happening to me a couple of years ago. I think I ended up deleting my account to stop it.
The Microsoft thing was happening to me a couple of years ago. I think I ended up deleting my account to stop it.
0
0
3
315
@lopp @c7five @Microsoft Same (6x). Also had a new social engineering phone attack come in yesterday. Spoke to the grunt running the phone op for a couple of minutes. I asked politely “please mark me as not a valid target if you can, thanks”, he responded that “it’s going to get much worse.”
0
0
0
114
@lopp @c7five @Microsoft I have been sent dozens in the past 24hrs too and though Fok this must be scammy
0
0
0
119
@loppe@c7fiven@Microsoftrt is how many people seem to be receiving these unsolicited Microsoft password-reset emails at roughly the same time.
One person receiving a reset code they didn't request is relatively routine. But when large numbers of unrelated users start reporting the same thing, that's potentially a much bigger security issue.
Is this a coordinated attack targeting Microsoft accounts? Are attackers using email addresses obtained from a data breach? Or is there a vulnerability in Microsoft's account-recovery system being exploited at scale?
A Microsoft breach isn't necessarily the explanation, but the apparent pattern deserves investigation. At some point, this stops looking like isolated account-recovery attempts and starts looking like a potentially coordinated campaign.
I'd like to see Microsoft acknowledge what's happening, explain the scale of the activity, and clarify what protections are in place.
One person receiving a reset code they didn't request is relatively routine. But when large numbers of unrelated users start reporting the same thing, that's potentially a much bigger security issue.
Is this a coordinated attack targeting Microsoft accounts? Are attackers using email addresses obtained from a data breach? Or is there a vulnerability in Microsoft's account-recovery system being exploited at scale?
A Microsoft breach isn't necessarily the explanation, but the apparent pattern deserves investigation. At some point, this stops looking like isolated account-recovery attempts and starts looking like a potentially coordinated campaign.
I'd like to see Microsoft acknowledge what's happening, explain the scale of the activity, and clarify what protections are in place.
0
0
1
167