Never enter a sign-in code someone sent you
Attackers can take over your account without your password — by getting you to type a code into a genuine Microsoft page.
- The scam: someone sends you a code, often disguised as a Teams meeting invite, and asks you to enter it at microsoft.com/devicelogin.
- The page is real. Entering the code signs the attacker in as you.
- Only enter a device code if you started the sign-in yourself, on a device in front of you (a TV, printer or conference-room screen).
- Be wary of unexpected meeting invites from new contacts, especially after friendly chats on WhatsApp, Signal or Teams.
- Entered a code you weren’t sure about? Tell IT immediately so your sessions can be revoked.
Based on: Microsoft Security — Storm-2372 device code phishing
Still stuck after those?
You’ve done the right thing by trying. Send whedo.it a quick note — what you tried, what you saw — and a senior pair of eyes will be on it the same business day.