Received 2FA verification code I did not request

Topic

New Reply

I received a 2FA code from TMobile last night, but had not tried to logon. I know they just had ANOTHER breach (they say no pw’s or financial info was taken, but who knows?) and they did not notify me that my info was involved (yet).  Anyway, I changed my email & pw on 1/19/23 when I found out about the breach.  So I get this code and then I think, what’s up with that?  I logged on & my account seems fine. BTW, when I logged on, the 2FA code was sent to the same  short code that the unsolicited one came in on, so it appears to be legit TMobile.  I changed my pw again (not the email).  You can logon with phone number or email id, so if someone has my phone number they could try to logon.

I use very long, strong, random passwords generated by a password safe, this one is 29 letters numbers & symbols. I just can’t believe someone got my pw! Is that possible? How is that possible?  Unless Tmobile was breached again since 1/19/23.

Also, back in Dec 2022 – this same thing happened with my Apple ID which really rattled me. I changed that pw and have not gotten any other codes since then, but why would this be happening and do I need to do something more to protect myself?  Why would I receive codes I did not request? thanks! Donna

Reply | Quote

Replies

2FA is protecting your accounts. This is good m’kay.

Changing your password is the appropriate response, no matter how / if your account has been compromised.

cheers, Paul

1 user thanked author for this post.

dmt_3904

Reply | Quote

If you’re still concerned about security (though it seems MFA is working), you can go to a hardware key. Here is a PC Mag article about various hardware keys you can use:

https://www.pcmag.com/picks/the-best-security-keys-for-multi-factor-authentication?test_uuid=00yyZwi7Jhwj42oJG5A1uwg&test_variant=b

1 user thanked author for this post.

dmt_3904

Reply | Quote