What identity never asks for
The secrets you type into identity and where you type them, and the things identity never asks you to send by email or hand to anyone.
On this page
The most useful habit against phishing is knowing exactly where you are ever asked for a secret. This page lists the few places, and the things that are never part of any identity message or page.
The one rule#
Identity never asks for your password by email. The sign-in alert page says it in so many words: We never ask for your password by email.
The same holds for every other message the platform sends. Each message in the list of genuine messages asks you to do one of two things: open a page and select a button there, or type a code on the identity page you started from. None asks you to reply with a secret, and none asks you to type a secret into the email itself.
Where you do type secrets#
Secrets are typed in identity's own pages, and only in these places.
| Secret | Where it is asked | When |
|---|---|---|
| Your Password | The Enter your password step of the sign-in page. Also Current password when you change it, and Choose a password (at registration, at a sign-in that finds none, and at the end of recovery) or Set password when you set one from your account. | When you sign in, or change how you sign in. |
| A passkey approval | A prompt shown by your own browser or device, not by a web page. You use your face, fingerprint or screen lock. | When you use or add a passkey. |
| Code from your authenticator app | Confirm it is you, and the setup step when you turn the app on. | At the second step, or when confirming a sensitive change. |
| A Recovery code | Use a recovery code, in the same sign-in step where your organization allows it, or the optional field on the recovery page. | When you have lost another second step. |
| Code from the email | The Check your email or Verify your email page, or the Confirm it is you page for the emailed code extra step and for Email me a code instead. It is typed in the browser where you started. | When you chose a code. |
In every case you start on the identity site yourself, or you arrive from an application you were already using. A message that sends you to a page and asks for these is the pattern to doubt.
What is never asked for#
- Your password in an email, a message or a call. See above.
- Your passkey. A passkey is a private key that stays on your device or in your password manager and works only on the real site. There is nothing to read out or send, so a request for it is a fake. Only an approval prompt from your own device is ever involved.
- The setup key or QR code for your authenticator app. The page shows them to you to put into your own app. Nobody else needs them. Whoever has the setup key can produce your codes.
- A set of recovery codes. The page that shows them says This is the only time they are shown. Store them somewhere safe. They are yours alone. See Keeping recovery codes safe.
- A one-time code that was sent to you, read back to someone. A sign-in code is typed in the browser where you started. The code email says do not share this code (English wording shown; the email follows the recipient's saved language) and explains why: if you did not just enter your password, your password may be known to someone else.
- A personal access token. A token is shown once when you create it and is for your own tools. Nobody legitimate needs you to send it.
Things that look similar but are different#
- A sign-in link you did not ask for. Someone typed your address into the sign-in page. Nothing changes unless the link is opened and confirmed, and the message says so. Ignore it.
- A confirmation page. Confirm this sign-in and Was this you? ask you to say yes or no. They do not ask for a password. They show the time, place and browser so you can judge, and you choose a button.
- An application asking for access. The Allow access page lists what an application is asking for and offers Allow and Deny. It states whether the application is verified by TDACorp. Granting access does not hand over your password. See Connected applications.
- A request to confirm it is you for a sensitive change. The Confirm it is you prompt asks for a passkey or an authenticator code, which you give on the page, not by email.
If something asked and you gave it#
Do not wait. Follow If you think your account was taken over now: sign out everywhere, change your password, replace your recovery codes and review your passkeys.
What this page does not cover#
This describes identity's own pages and emails. It cannot say what another website, an app built on identity or a message from some other channel will ask. If anyone contacts you by phone, chat or social media and asks for something in the list above, treat it as suspicious, and check by going to the identity site yourself.