2 min read
What's happening
Two-factor codes are only sent when someone is trying to sign in or authorise something. If one arrives and it wasn't you, the likely explanation is that someone else has entered your password and is being stopped at the second step — which is exactly 2FA doing its job.
What to do
Never read the code to anyone, and never approve a prompt you didn't start. Change your password to a new, unique one right away, review your sessions, and report it via reporting suspected fraud. This is a good moment to add a passkey too.
Related reading
Setting up an authenticator app for two-factor authentication
Two-factor authentication adds a second step to sign-in: after your password you enter a six-digit code from…
Read →
Reporting suspected fraud to Credit Corp
If you spot something wrong — a scam pretending to be us, a strange login, an unexpected change — report it…
Read →
Managing trusted devices and active sessions
Your account keeps a list of the devices and browsers currently signed in. Reviewing it — and removing…
Read →
Choosing a strong passphrase for your business account
A passphrase — three or four unrelated words — is both stronger and easier to remember than the old-style…
Read →Funding for UK limited companies
Credit Corp lends to your company, not to you personally — short-term working capital with no personal guarantee. See what your business could access.