A one-time verification code is meant to prove that you control an account or device. It is not a password to pass along to someone who says they are from support, a colleague, or an automated assistant. An unexpected request can mean someone is trying to sign in or change account settings using your details. You may receive a code even if you did not start the action yourself. Treat the request as a warning: do not share the code, pause before clicking anything, and use the service’s official sign-in or recovery route if you need to check your account.
The useful bits
- Never give a one-time code to a person, email sender, or assistant.
- Ignore unsolicited requests and start account checks from the official site or app.
- If you disclosed a code, secure the account promptly through official recovery.
Why a code request matters
A verification code is a temporary credential. Someone asking for it may be trying to complete a sign-in, reset a password, or approve another account action. The code can arrive legitimately even when you did not initiate anything: an unauthorized person may have entered your email address or phone number and triggered the service to send it.
The story attached to the request does not make sharing safe. A caller may claim that a code is needed to stop fraud, restore access, or verify your identity. An email may imitate a service notice. A person or assistant may say they are helping you troubleshoot. None of these claims makes the code theirs to use. A legitimate helper should not need you to reveal a code that proves control of your account.
When a request arrives unexpectedly
Do not read the code aloud, paste it into a chat, forward the message, or reply with it. Do not click a link in the request to check whether it is genuine. Close the message or end the conversation, then open the service using an address or app you already know is official. If you did not request the code, you can usually leave it unused; do not try to enter it into a sign-in flow you did not start.
You can block or report a suspicious sender using your mail or messaging service’s available controls. Avoid engaging to challenge the sender: a response can confirm that your address or number is active. If a real sign-in attempt was made, the service may send a separate notice. Assess it independently by visiting the official account site, not through a link supplied in an unexpected message.
A message says: “We are helping restore your mailbox. Send us the code that just arrived.” Do not send it. End the conversation, open the mailbox service through its official address, and check the account there.
If you already disclosed the code
Act promptly, but do not let urgency push you into another message link. Go directly to the service’s official sign-in or account recovery page. If you can still sign in, change the account password to a new, unique one. If you use that password elsewhere, change it on those other services too. A code may have enabled an account action, so also review the account’s security settings and recent activity if those options are available.
Look for changes you did not make, such as unfamiliar recovery details, forwarding rules, connected devices, or sent messages. The exact checks and controls vary by provider and account. If you cannot sign in or a recovery detail has been changed, use the provider’s official recovery process rather than instructions from the person who requested the code. Do not send another code or your password to anyone offering to fix the problem.
Use the official route for BITTU Mail
BITTU Mail is powered by BITTU ICLOUD. All sign-in, registration, account recovery, and account actions go through https://mail.bittuicloud.com. If a message claims that you must share a code to protect or restore a BITTU Mail account, do not reply with it. Open the official account address yourself and follow the recovery steps shown there if access is at risk.
If you regain access, review the account settings that are available to you. Optional two-factor authentication may be available, but controls depend on account state and provisioning. Do not assume a setting is enabled or that a particular control exists for every account. If you cannot complete recovery, continue through the official route rather than relying on a contact address or link supplied by the requester.
A quick pause-and-check routine
Before acting on any code-related message, stop and ask whether you initiated the sign-in or account change yourself. If not, treat the code as private and the request as untrusted. Use this short checklist:
- Keep the code private, including from people claiming to be support or an assistant.
- Do not follow links or reply to an unsolicited request.
- Open the official service address independently and check the account there.
- If you shared a code, use official recovery, change the password if possible, and review available security details.
Confirm the account is back under your control
After taking action, confirm that you can sign in through the official site and that your password works. Check that the recovery information and account details you can view are familiar. Review available activity for signs of changes you did not make. If anything remains unfamiliar, or you still cannot access the account, return to the official recovery process; do not treat a reassuring message from the requester as proof that the issue is resolved.
A code you never requested is a reason to be cautious, not a reason to hand over more information. Keeping it private, checking through a known official route, and recovering access there are the safest next steps.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction