Why am I being asked for additional verification on signin?
Hi, everyone.
Leo Notenboom here for Askleo.com
with what can turn into a very frustrating scenario.
Here's the one I hear frequently
someone travels overseas or to a neighboring country.
They attempt to sign in to Outlook.com
to check their email.
After specifying the correct
username and password, they're asked for additional information
in the form of a code texted to their phone.
They have no way to retrieve the message
because their phone is back home or just doesn't work where they're at.
The result,
they can't sign in.
Yeah, that is frustrating.
There are ways to prepare for it, but I think the most common question is,
why is Microsoft doing this at all?
It's not limited to just Microsoft.
There are other providers that will act
in the same way under certain circumstances,
but my experience so far seems to indicate that Microsoft is probably the most common
service against which I get this report.
The issue is an unfortunate one.
The reality
is that your Microsoft account, my Microsoft account,
every Microsoft account, whether it be a Hotmail account,
an Outlook dot com account, a Web TV account,
any of the other Microsoft provided free email addresses,
they are all under pretty much constant attack,
various mechanisms.
The other thing that happens, of course,
is that these email addresses get exposed in data breaches,
and hackers will collect them, and they will start trying to use them.
The problem, of course, is that due to a variety of reasons, hackers are
successful a little too often.
So Microsoft has to take additional steps
to make sure that when something seems unusual
out of character for your account,
they take a couple of extra steps to make
sure that it's really you and not some hacker. What does it mean to be unusual?
Well, as kind of inferred by the dialogue
you're looking at signing in from a new location or signing in from a new device
or signing in from a new app on an existing device.
These are all kinds of things that they're just different.
They're unusual.
They are not the norm for your account, and to err on the side of safety,
to err on the side of security, to err on the side of your account
not getting hacked by someone that shouldn't have access.
Microsoft throws up this additional barrier.
Location of all of these probably matters
most, and it's actually very easy to see why.
Hackers are never where you are, hackers that have taken a database,
or maybe they've successfully installed malware on your machine,
or they've done something that has them either getting your account credentials
and successfully attempting to log in as you.
They're never where you are.
In fact, they're almost always in another country completely.
So when all of a sudden your account gets logged into from a country
that is not the same as your most common or most recent login.
Yeah, Microsoft is actually pretty right in taking that as a sign that, you know,
maybe we better check
and better checking means, yes,
if a hacker does happen to get your stuff,
they won't be able to get in because Microsoft threw up this barrier.
Now, of course, the problem is that if you legitimately have this happen to you,
that can be a problem.
If you, for example, you sign in to your Hotmail
before you leave on a trip, you land in another country
and all of a sudden, yeah, it seems like not only are you
logging in from a different country, you did it pretty darn quick.
So Microsoft throws up this additional security question.
What if you can't answer it?
Well, you might not be able to get into your account until you get back home.
That can be a real problem.
Now, there are some ways to prepare for that.
One is to make sure your account has
associated with it alternate access mechanisms that you can access,
for example, an email account that doesn't require these kinds
of geographical based checks in order for you to sign in.
Obviously, if you do have another account that does also include these geographical
location based checks, then you may not be able to log into that one either.
You may not be able to confirm your identity that way.
Realize that SMS is an option.
And if you can't get SMS,
then you can't get the code.
Make sure you've got either an SMS you know, will work
where you are traveling to, or you have alternate email or alternate
authentication mechanisms that can be invoked when that happens.
And, of course, if possible, a voice message delivered to that phone.
All of these things have to be set up in advance.
They need to be set up before
you need them, because you need to be signed in to set them up.
And if you're traveling and you can't sign in, well, it's too late.
You can't set them up.
So make sure you've got these
alternate identification mechanisms, be it an alternate email address or two.
I think I have two, maybe three associated
with my account, an alternate phone number.
As long as that phone number works
to where you're going or an alternate voice number.
That again, make sure that it works where you are.
I don't think Microsoft offers voice only,
but it is an option from any other services.
Now, there are additional steps
that honestly, you should be setting up anyway,
especially if you are using two factor
authentication, which you should. Coincidentally,
two factor authentication kind of saves you here because that second factor is
often the kind of stuff that Microsoft would throw up as that additional barrier
to entry for logging in from an unknown location.
It can be your alternate email address.
It could be your Google Authenticator.
It could be account recovery codes that you have generated,
saved and have with you or have accessible to you while you're traveling,
make sure that you understand this can happen
and then make sure you understand what your alternate verification
mechanisms are with the service you're interested in using.
Make sure that they're set up beforehand and you shouldn't have a problem.
Like I said, the worst case scenario is that you'll be protected from yourself.
In that case, you may not be able to gain
access to that account until you return home or updates.
For related links for comments and more, visit
askleo.com/92840
I'm Leo Notenboom this is Ask Leo.com