What a security alert email means

• Alerts go to every verified address on the account, one message to each. If you have a second verified email address, both receive it.
• They follow your saved language. The emails are sent in the language saved on your profile (English, French or Spanish); the wording on this page is shown in English. See Languages.
• They cannot be switched off. The Notifications settings page says Security alerts are Always on: sign-in alerts and account changes are sent whatever you choose.
• Sending is best effort. A change is not held up if an email fails to send. So a missing email does not prove nothing happened. The Notifications page in your account lists security events as they happen. See Notifications.
• Links in an alert open a page that asks you to confirm. Nothing changes until you select a button on that page.

The message lists Device, Country, Address, Method and Time of a sign-in from a device the account had not seen. It says If this was you, no action is needed. and, if it was not, to sign that session out or secure your account. The button Review this sign-in opens a page titled Was this you? that says We signed someone in from a device we had not seen before. The link works once and the message gives its expiry. It is always sent after a sign-in that used Continue with my password only (limited session), even from a browser the account has seen, because that browser stays untrusted until a sign-in proves more than the password.

The page adds We never ask for your password by email. Choose No, secure my account if you suspect more than one session. Then follow the email that arrives.

After you choose to secure the account#

The next message is titled Your account was secured. It says every session, API token and remembered device was ended. It does not claim your password changed, because it did not: so you must change it. The message tells you to sign in again and change your password from the security page, and may offer Start recovery to set a new password without signing in.

If your passkey is your only second step, a person who knows your password can ask for an emailed code instead. Two messages follow. The code email, subject Your TDACorp Identity sign-in code (your passkey was skipped), goes to the address being signed in and has a Secure my account button. Your other verified addresses get A sign-in skipped your passkey when the first code is sent, before anyone has used it. It says someone signed in with your password and an emailed code instead of your passkey, shows the Time, and offers Secure my account. If that sign-in completes, it also always sends the New sign-in to your account alert above. If it was you, no action is needed. If not, use Secure my account and change your password.

These share one shape. The subject is Security alert: followed by what happened, the body repeats it, shows the Time, and says If this was you, no action is needed. If it was not, the message says to review your account now and offers Review your account. Events you may see:

If you made the change, nothing more is needed. If not, treat it as a takeover. Go to If you think your account was taken over.

Two messages belong to the emailed code that replaces a lost passkey (see The second step).

• Your TDACorp Identity sign-in code (your passkey was skipped) goes to the address you are signing in with. Its heading is Your passkey was skipped. It says that someone entered your password and asked for an emailed code instead of using your passkey, shows an eight digit code, and says the code expires and works once. If it was not you, it says not to share the code, that your password may be known to someone else, and offers Secure my account.
• A sign-in skipped your passkey goes to every other verified address on the account, as soon as the code is requested and before it can be used. It says that someone signed in with your password and a code sent by email instead of your passkey, shows the Time, and says If this was you, no action is needed. If it was not, secure your account now. with a Secure my account button. An account with no other verified address sends none.

The button in both opens account recovery, which asks you to confirm before anything changes. A sign-in that finishes this way also sends the ordinary New sign-in to your account email.

• A sign-in to your account was blocked because it looked risky. The message says if it was you, try again from a browser you have used before or add a passkey, and if not, no action is needed but consider changing your password.
• There were many failed attempts to sign in to your account, so further attempts are being slowed down. This can come from someone guessing. It says no action is needed, but consider changing your password.
• A sign-in token for one of your connected apps was reused, which can mean it was stolen. As a precaution every session, app connection and API token on your account was ended. Sign in again, and review your security settings if this was not you.

The first two describe attempts that were stopped or slowed. They are not the same as a break-in.

Your primary email was changed goes to the old address, and says the primary email was changed to the new one and that it signed you out of every device. If you did not do it, Revert the change opens a confirm page. The message says a confirmation step follows before anything changes, and gives the time the link expires.

• Recover your TDACorp Identity account is the link you asked for. Opening it changes nothing.
• Account recovery started: cancel it if this was not you says recovery is held and nothing about your sign-in methods changes before the time shown. Cancel recovery stops it.
• Your account recovery is on hold says a hold is still running and gives the Available after time.
• A recovery code was not accepted says nothing was changed and suggests changing your password if it was not you.

• Recognising a phishing email
• Sessions and devices