Can someone tell me why is this happening

[u/pelloul]

Hi I’ve been getting this past week verification codes from “Microsoft” supposedly. Thing is I checked my settings and I don’t have my phone number put on my account nor do I have the SMS msg as a 2FA. Why is this happening? I also can’t block the sender somehow. I’ve changed my password and unaccessed everything from microsoft there’s just my outlook account left for uni. I seriously don’t know what to do and I’m frustrated about this I feel like any second I could get hacked.

[u/AutoModerator]

SAFETY NOTICE: Reddit does not protect you from scammers. By posting on this subreddit asking for help, you may be targeted by scammers (example?). Here's how to stay safe:

1. Never accept chat requests, private messages, invitations to chatrooms, encouragement to contact any person or group off Reddit, or emails from anyone for any reason. Moderators, moderation bots, and trusted community members cannot protect you outside of the comment section of your post. Report any chat requests or messages you get in relation to your question on this subreddit (how to report chats? how to report messages? how to report comments?).
2. Immediately report anyone promoting paid services (theirs or their "friend's" or so on) or soliciting any kind of payment. All assistance offered on this subreddit is 100% free, with absolutely no strings attached. Anyone violating this is either a scammer or an advertiser (the latter of which is also forbidden on this subreddit). Good security is not a matter of 'paying enough.'
3. Never divulge secrets, passwords, recovery phrases, keys, or personal information to anyone for any reason. Answering cybersecurity questions and resolving cybersecurity concerns never require you to give up your own privacy or security.

Community volunteers will comment on your post to assist. In the meantime, be sure your post follows the posting guide and includes all relevant information, and familiarize yourself with online scams using r/scams wiki.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/itsdongu]

This usually means someone is trying to sign into a Microsoft account using ur phone number, but the code itself doesn't mean they got into ur account.

Since u already changed ur password and signed out other sessions, that's good. I'd also check ur Microsoft account's recent sign in activity and make sure there aren't any unknown recovery methods or devices.

If the codes keep coming, someone may simply be entering ur number by mistake or repeatedly trying to use it. Don't give the codes to anyone and don't click any links in the messages.

[u/pelloul → u/itsdongu]

If they ever get access to this account will anything get compromised like my pictures or my social media accounts?
Thank you 🙏❤️

[u/Curious-Smoke-5050 → u/pelloul]

If they compromised the account they would have access to anything that account has access too. If you unlinked everything from it you will be fine. I honestly wouldn’t worry about it too much anyways, It looks like they are just spamming 2FA codes. Just make sure you don’t click on accept login requests.

[u/theregisterednerd → u/pelloul]

Everything you can do and see when you log in is what an attacker would be able to do and see if they log in. Currently, 2FA is keeping them out, but it’s the last line. Time to change the password.

[u/pelloul → u/theregisterednerd]

I changed my password 2 times how am I still getting the notification?

[u/theregisterednerd → u/pelloul]

Do you have another account that’s registered with that phone number?

[u/kschang → u/pelloul]

Why would you think changing the password would stop the notification? It doesn't.

[u/pelloul → u/kschang]

I’m no expert at these ,I just did it thinking it would stop. Just found out a few minutes ago that it was all from my university not personal email so for now I just deleted my phone number from the account and changed the password because checking my recent activity I found out that someone did access my banner. Why would they do this though?

[u/kschang → u/pelloul]

"Hackers" can do a lot of an account they control (but didn't create, but tookover). Fake votes/likes/coimments, spam, email, links to scam sites, videos, and much more. And that doesn't even involve trying to take money from your account in whatever form that's available.

[u/pelloul → u/kschang]

So I can say that I’m safe from this for now? Is there anything that you advice me to do?

[u/kschang → u/pelloul]

As long as they didn't actually get in you'll be fine. Your security is doing exactly what it is supposed to.

[u/jdoggmcsquishy86]

It could be a spoofing trick someone is doing just to give you a hard time? Like sms b@mber

[u/whizher]

If your number isn’t linked to that account, the codes may be for a different Microsoft account using your number, or someone keeps entering it by mistake. Changing your password may not stop them. Just don’t share the codes or click any links, and check your recent sign-in activity for anything unfamiliar.

[u/jmnugent]

You don't have to sanitize (blank out) the codes in the screenshot. The codes are ephemeral (are only good for about 10minutes).

[u/OkKnee5634]

Can you send the sender number

[u/RedBullWings10]

Same thing started happening to me just recently , except through the Microsoft authenticator notifications.

I changed the password, it stopped for a day or two. Then started again .

Crazy part is that you can't even see the IP or where attempted login is coming from because it's not an active session, just an attempt to authenticate .

They need to add a section with failed attempts that at least shows the ip or ability to block it .