Microsoft MFA is randomly texting codes. Account shows no activity at time of texts.

%3CLINGO-SUB%20id%3D%22lingo-sub-2205545%22%20slang%3D%22en-US%22%3EMicrosoft%20MFA%20is%20randomly%20texting%20codes.%20Account%20shows%20no%20activity%20at%20time%20of%20texts.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2205545%22%20slang%3D%22en-US%22%3E%3CP%3ELast%20night%20as%20I%20was%20asleep%2C%20I%20received%20three%20consecutive%20texts%20from%20Microsoft%20with%20an%20MFA%20code%20for%20accessing%20my%20account.%26nbsp%3B%20In%20a%20panic%2C%20I%20checked%20the%20login%20history%20of%20my%20corporate%20account%20(Azure%20based)%20but%20it's%20only%20showing%20valid%20connections%20from%20my%20IP%20address%20and%20no%20login%20attempts%20at%20the%20time%20of%20the%20MFA%20texts.%26nbsp%3B%20I%20connected%20with%20our%20IT%20team%20this%20morning%20and%20they%20confirmed%20that%20there%20were%20no%20logins%20anywhere%20near%20the%20time%20the%20texts%20were%20received.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAll%20three%20MFA%20codes%20were%20exactly%20the%20same%20in%20the%20texts%20and%20they%20definitely%20came%20from%20the%20Microsoft%20MFA%20service%20(came%20from%20the%20same%20number%20I%20have%20received%20codes%20from%20previously).%26nbsp%3B%20Each%20code%20was%20received%205%20to%2012%20minutes%20apart.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWhat%20could%20have%20triggered%20the%20MFA%20services%20to%20text%20me%20when%20no%20account%20login%20was%20being%20attempted%3F%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2408872%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20MFA%20is%20randomly%20texting%20codes.%20Account%20shows%20no%20activity%20at%20time%20of%20texts.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2408872%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F995666%22%20target%3D%22_blank%22%3E%40DeadTaco%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDid%20you%20ever%20get%20a%20response%20on%20this%20from%20Microsoft%3F%3C%2FP%3E%3CP%3Ethanks%2C%3C%2FP%3E%3CP%3EL%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Last night as I was asleep, I received three consecutive texts from Microsoft with an MFA code for accessing my account.  In a panic, I checked the login history of my corporate account (Azure based) but it's only showing valid connections from my IP address and no login attempts at the time of the MFA texts.  I connected with our IT team this morning and they confirmed that there were no logins anywhere near the time the texts were received.

 

All three MFA codes were exactly the same in the texts and they definitely came from the Microsoft MFA service (came from the same number I have received codes from previously).  Each code was received 5 to 12 minutes apart.

 

What could have triggered the MFA services to text me when no account login was being attempted?  

2 Replies

@DeadTaco 

 

Did you ever get a response on this from Microsoft?

thanks,

L

@llanchor 

 

Nope, never heard anything and it hasn't happened again ever since that day.