“Enter this code to sign in”? Only if you started it

This scam is clever because everything you see is real. An email asks you to view a document, a voicemail or a password notice. The page you land on shows a short code and sends you to Microsoft's genuine sign-in page, microsoft.com/devicelogin, to enter it. If you do, you've just signed the scammer in to your account. They don't need your password, and your MFA doesn't stop them, because you approved it.

The rule

Only enter a sign-in code on microsoft.com/devicelogin if you started signing in on another device in front of you, such as a meeting room screen or a TV app. A code that arrives in an email, a message or on a web page is a scam.

Signs to look for

• An email about a shared file, a voicemail, an e-signature or an expiring password, with a “Verify” or “Continue to Microsoft” button
• A page that shows you a code, or says it has copied one for you
• A sign-in prompt that names an app you weren't using

If you've entered a code you didn't start, call us on 707-755-8000 straight away. We'll sign out every session on your account and secure it.