What will support never ask me for?

What must you never share?

Support, the helpdesk, the provider and the automated assistant never ask you for:

• your password;
• your recovery codes;
• the authenticator app's six-digit code;
• the six-digit code the phone shows while being linked;
• approving on your phone a request you did not make;
• SCIM tokens, OIDC or RADIUS client secrets, or private keys.

If anyone asks you for one of these, it is a fraud attempt, even if it seems to come from your organization.

What about Windows recovery with the helpdesk?

It is the only planned code exchange, and it works the other way round: you read the challenge code Windows shows to the technician, and the technician reads the response code to you. The screen itself warns that support never asks for your password or phone codes. See Helpdesk recovery.

What can support ask for?

• your email and the organization's name;
• the approximate time of the problem;
• the exact error message or a screenshot with no codes visible;
• the computer's or phone's name.

I shared a code by mistake. What now?

1. Change your password at once, if you shared it.
2. If you shared recovery codes, create new ones: the old ones stop working.
3. Review your sessions and trusted devices and end what you do not recognise.
4. Tell your organization's security team.