I gave someone my sign-in code

Why it matters

A sign-in code from text message, email or an authenticator app is the second step that protects your account when a password is stolen. Whoever has the code, within the few minutes it works, can usually finish signing in as you.

Nobody legitimate needs you to read out a code. Not your bank, not Microsoft and not your IT team. The only place to type it is the sign-in page you opened yourself.

What to do now

1. Call your IT provider straight away. For a work account, they can sign out every session, reset your password and check what the attacker did. Minutes matter.
2. Change the password for that account from a device you trust, if IT has not already done it.
3. Check sign-in methods. Attackers often add their own phone or app as a sign-in method so they can come back. IT should remove anything you do not recognize.
4. Check email rules and forwarding. A common next step is a hidden rule that forwards or deletes messages.
5. Warn people if the account could be used to message them, such as clients and suppliers.

For a personal account

Contact the company through its official app or website, never through a number in a message, and follow its account recovery steps. If it was a bank account, call the bank on the number on your card.