AI Tools
Got a ChatGPT verification code you did not request?
An unexpected code is a reason to check, not proof of a takeover. Identify the message, keep the code private, and inspect your account through the official site.
Contents
You did not try to sign in to ChatGPT, yet a code arrived in your inbox. Do not share it or follow an urgent link in the message. An unexpected email alone does not prove someone entered your account. As of October 10, 2026, OpenAI documents different flows for login codes and new-account email verification; start by identifying which one you received.
Is it a login code or a sign-up email?
| Message | What it may mean | First response |
|---|---|---|
| One-time code for sign-in | Someone started a login challenge, perhaps from another device or with a mistyped address | Keep the code private; check your account by typing chatgpt.com yourself |
| Link to verify a new sign-up | Someone entered your email while creating an account | If you did not sign up, ignore the message and do not approve the link |
| Urgent demand to click a link or tell “support” your code | It may be a phishing attempt | Open the official site independently; do not reply with the code |
OpenAI says an unrequested sign-up verification email can safely be ignored: the new account is not created unless the link is approved. A login OTP is different. It signals a verification attempt, but the email alone does not tell you who initiated it or whether anyone got in.
Check the sender without trusting the email blindly
OpenAI lists noreply@tm.openai.com and otp@tm1.openai.com as legitimate login OTP senders. Inspect the complete address and any link destination; a display name or logo is easy to imitate. Even a genuine code should only be entered into an official login flow you started yourself. If you did not start one, leave the code unused.
If you gave the code to someone or entered a password on an unfamiliar site, act immediately. A code does not by itself mean your password was exposed, but it could complete the login attempt underway.
What to do if account activity looks unfamiliar
- Secure the sign-in method. If you use an OpenAI password, replace it with a unique one. If you sign in with Google, Apple, or Microsoft, inspect that provider and the linked email account; change any credential you believe was exposed.
- Review sessions. Open ChatGPT settings, then Security and Active sessions. Look for devices or changes you do not recognize. Locations can be approximate. Sign out unfamiliar sessions or all sessions if needed; OpenAI says sign-out across devices can take up to 30 minutes.
- Add an available second factor. Set up MFA or a passkey and retain a recovery method. Enabling MFA does not end existing sessions, so do the session check separately.
- Report actual unauthorized activity. Save timestamps and screenshots of unknown sessions, changes, charges, or API usage, then contact OpenAI Support through its Help Center. Never send a password or one-time code.
If this was a single unsolicited code and you find no other suspicious activity, you can leave it unused and monitor the account. Repeated codes or unfamiliar sessions warrant the full security check.
Two common questions
Does receiving a code mean my password was stolen? No. It shows that a verification flow was triggered. Use your session history and unauthorized changes to assess what happened.
What if a code I requested never arrives? Check the account inbox, spam folder, and sign-in method, then use our ChatGPT login and verification guide. If ChatGPT shows a warning banner, save its wording and contact official support.