First, confirm: did you trigger the email?
The strongest trust signal is neither the logo nor the tone—it’s a clear cause-and-effect timeline. You clicked “Send code” on a specific service, then received the matching email within seconds. That chain makes sense. If you did nothing, treat the email as suspicious even if it comes from a familiar brand.
Don’t rush to copy the code, and never click “Cancel” or “This wasn’t me” in the email. Open the service’s official app or manually enter the official address you saved, then check your sign-in activity and security alerts. An unexpected code could mean someone entered your email by mistake—or that a credential-stuffer has already passed the first password check.
- The request happened within the last two minutes and you initiated it.
- The service and action named in the email match the page you’re using.
- The code is only for entering back on the original page; never forward it to anyone.
Signal 1: The request time matches the code’s validity window
Legitimate verification codes usually expire quickly and apply to one specific session. An email that arrives many minutes late, keeps repeating, or continues after you close the page should be trusted less. An attacker may repeatedly request codes to create alert fatigue, then pose as support and ask for the latest one.
If a code is delayed, return to the original page and request another one. Use only the newest email, and confirm that its final digits or destination address match the page. Treat older codes as expired—don’t try them one by one.
Signal 2: Verify the real sender domain, not the display name
“Account Security Center” is just a display name that anyone can enter. Expand the message details and check the complete From address, whether Reply-To looks unusual, and whether SPF, DKIM, or DMARC passed. Authentication doesn’t guarantee that the business request is legitimate, but a misspelled domain, a free-mail sender, or a Reply-To address leading to an unfamiliar domain is a clear reason to stop.
| What to check | Usually normal | Warning signs |
|---|---|---|
| Display name | Matches the service name | Impersonates “urgent support” |
| Full domain | Public notification domain used by the service | Extra or missing letters; unusual subdomain |
| Reply address | Doesn’t ask you to reply with the code | Personal email address or messaging account |
Signal 3: The described action matches the service
A signup code, login code, and password-reset code authorize different actions. If you’re creating a new account but receive a code to “reset your existing password,” stop immediately. The email should clearly describe the action, but it should never ask you to send the code to support, a seller, a recruiter, or a “verification bot.”
For temporary signups, use an online disposable email to keep marketing tracking separate. But if the account needs recovery, payments, or long-term access, switch to a controllable forwarding alias so you don’t lose the recovery path when the temporary address expires.
Signal 4: Don’t use an email link to return to the sign-in page
A verification email may include a convenient button, but the safer route is to return to the page you already opened and enter the code there. If you closed it, start again from a bookmark, the official app, or a URL you type manually. Hovering over a link can reveal obvious problems, but it cannot prove that the final redirect is safe.
A QR code is also a link. Don’t scan an unfamiliar QR code with another device to “complete verification”; it could authorize your current sign-in session to an attacker. A password manager refusing to autofill is also a useful warning that the domain may not match.
Signal 5: The device, location, and session details line up
High-quality security alerts include the device type, browser, approximate location, or request time. Location can be inaccurate because of mobile networks or VPNs, so it should not be judged alone. But an unfamiliar device, a completely different country, and a time when you weren’t active together indicate high risk.
Combine multiple weak signals: a city mismatch may be explainable, but an unfamiliar system plus an unusual time plus a request you didn’t make means you should immediately change your password, revoke sessions, and check multifactor authentication.
What to do after receiving an unfamiliar verification code
- Don’t reply, click email links, or give the code to anyone.
- Use the official entry point to review recent sign-ins and active sessions, then revoke unfamiliar devices.
- Change the service’s unique password. If you reused it, update the other accounts too.
- Enable an authenticator app or security key, and save your recovery codes offline.
- If this address has started receiving a steady stream of attack emails, use the Exposure Assessment Tool to decide whether to migrate or replace the alias.
A verification code is a one-time secret, not proof of identity. Check who initiated it, what it authorizes, and where it should be entered. Most social-engineering attempts become obvious before you type the numbers.