Unexpected Microsoft Verification Codes? Here’s What’s Happening & How to Stay Safe

Users of Microsoft accounts across Portugal and Brazil are reporting an unexpected surge in authentication codes delivered via SMS or email—codes they never requested. The messages, sent without prior notification, appear to originate from Microsoft’s security systems, triggering confusion among recipients who question whether their accounts have been compromised.

According to verified reports from multiple Portuguese-language tech and security outlets, the phenomenon began in early June 2026, with users describing identical experiences: receiving a six-digit verification code via SMS or an email from [email protected]—yet having made no recent attempt to log in. In some cases, the messages arrive alongside alerts about “unusual sign-in attempts” from unfamiliar devices or locations, even when the user has not traveled or installed new software.

Microsoft’s standard security protocol, as outlined in its official support documentation, dictates that such codes are sent only when an account detects activity from a new device, location, or application. However, the reports suggest a discrepancy: users confirm they have not initiated any sign-in attempts, yet the codes arrive unprompted. The company’s documentation also specifies that legitimate alerts include a sender address from [email protected], which matches the emails described in the reports.

While Microsoft has not issued a public statement addressing the specific surge, its broader security practices—including multi-factor authentication (MFA) via SMS or the Microsoft Authenticator app—are designed to prevent unauthorized access. The company’s support pages emphasize that users should verify the sender’s email address and avoid sharing codes with anyone, even if the message appears legitimate. The absence of a direct response from Microsoft has left users and security analysts to speculate about the cause.

One plausible explanation, corroborated by recent discussions in Portuguese tech forums, is a misconfiguration in Microsoft’s authentication systems. Such errors have occurred in the past, including a 2025 incident where users reported receiving unsolicited MFA messages after a system update. However, Microsoft’s official channels have not confirmed whether this latest wave is linked to a technical glitch, a targeted phishing campaign, or another factor.

Security experts consulted by Portuguese media outlets warn that users should treat unexpected codes with caution. Even if the messages are legitimate, sharing the codes could expose accounts to hijacking. The experts recommend reviewing recent account activity through Microsoft’s Recent activity dashboard and updating recovery contacts if unusual alerts persist.

For now, the phenomenon remains unresolved. Microsoft has not acknowledged the reports, and users continue to receive codes without explanation. The lack of official clarification leaves open the possibility of either a systemic issue or a coordinated attempt to exploit trust in Microsoft’s security infrastructure.