I use a PayPal account with Two-Factor-Authentication (2FA). Whenever I log in, after entering my password, I receive a code by text message like the following that I have to enter:

PayPal: Your security code is: 123456. Your code expires in 5 minutes. Please don't reply.

The above format and the sender (+1 729725) have been pretty consistent for me for months.

Yesterday night, I received three text identical messages within one minute - while sleeping:

PayPal: Your confirmation code is: 234567. Your code expires in 5 minutes. Please don't reply.

They were sent from the usual sender, and since also the format resembled the previous ones, I feared that someone might have my PayPal password and trying to get past 2FA. Then I noticed that they said "confirmation code", while all other text messages from PayPal say "security code". However, PayPal support has since confirmed that PayPal sent them.

Now I want to find out how the text message was most likely triggered. Does someone really have my password? Or maybe someone just mistyped his phone number somewhere? I have found out that you can trigger sending text messages without knowing the password (this is basically a "forgot password" technique). However, whatever way I try to trigger another text message, I only receive a "security code", never a "confirmation code". You may think that a "confirmation code" sounds less important than a "security code", but I would like to be somewhat certain.

So what is a confirmation code? How can messages with a confirmation code be triggered? And what does receiving confirmation codes without my interaction mean for my account security?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.