I got a verification code I did not ask for — what does that mean?

Why an unexpected code usually means the password is already known, the one thing never to do with it, and the fifteen minutes of work that closes the door.

Difficulty: beginner
Time: 15 min
Read: 3 min
Safety: warning

Short answer

Somebody is trying to sign in as you, and if the site sent a second-factor code rather than a reset link, they very likely have your password already. Never share it and never approve the prompt. Change that account's password now from a trusted device, sign out all sessions, and check recovery details and forwarding rules.

Most people ignore these, and most of the time nothing follows. That is because the second factor did its job. But the message is genuinely informative: it usually means a password of yours is in circulation and is being tried, which is worth acting on rather than dismissing.

Safety

An unrequested code means somebody is actively trying to get into an account of yours right now, and in most cases they already have the password. Do not share it, do not tap approve, and do not reply. Change that account's password from a device you trust within the next few minutes.

Step by step

Do not share it and do not approve it.Not with anyone, for any reason, including someone who rings within seconds claiming to be the service's security team. That call is the attack, and it is the standard follow-up.
Work out which account it was for.The message says. Note whether it was a sign-in code, a password reset code, or a change-of-details confirmation, because each means something different.
Treat a sign-in code as password compromise.If the site issued a second-factor code, the first factor was accepted. Change that password immediately from a device you trust, and change it anywhere you reused it.
Treat a reset code differently.A password reset code means someone triggered the forgotten-password flow with your address. That does not imply they have your password, but it does mean they are targeting the account. Ignore the code and check the account's security settings.
Sign out of all other sessions.In the account's security settings. It ends any session the attacker may already hold, which a password change alone does not always do.
Check what they may have changed.Recovery email addresses and phone numbers, mail forwarding rules and filters, trusted devices, connected apps, and payment methods. Attackers set these up to keep access after a password change.
Strengthen the second factor.If the code arrived by SMS, move that account to an authenticator app or a passkey. If prompts arrive repeatedly, that is prompt fatigue being attempted — switch to a method that requires you to enter or match something.
Check whether that password has leaked.Search your email address on a reputable breach service. Repeated unrequested codes usually mean a leaked pair is being replayed.

Tips

Repeated prompts over minutes or hours are deliberate. The tactic relies on someone tapping approve to make it stop. Never approve one to end it — change the password instead.
If codes arrive for an account you do not recognise, someone may be trying to register a service with your number or address. Ignore it, and do not follow any link in the message.
One unexplained code is worth acting on. A pattern of them is worth treating as an active attack on that account.

Common mistakes

Ignoring it because nothing happened — Nothing happened because the second factor held. The password behind it is still exposed and will be tried elsewhere.
Approving a prompt to stop the notifications — That is precisely the outcome the repeated prompts are engineered to produce, and it grants access.
Reading the code to someone who rings straight after — The timing is the tell. Legitimate services never ring to ask for a code they just sent you.

Questions people ask

Does it definitely mean my password was leaked?

A sign-in code strongly suggests it, because the password had to be accepted first. A reset code does not — that only needs your email address or username.

Should I tell the service?

Where they offer a report route in the message, yes, and it is worth checking the account's recent activity log. Otherwise the password change and session sign-out are the substantive actions.

What if the code was for my bank?

Ring the bank on 159 or the number on your card, tell them, and ask them to check for new payees and device registrations.