Related

Unrequested security passcodes

simondaw

In the past twelve hours, I have received two unrequested security passcode emails. After the first, I reset my password, although I think it's unlikely that my old password had been compromised at my end. The second was received a few hours later. 

Anyone else getting this? Blooper on Garmin's part, or a breach somewhere down the line? 

  • 0

    I'm not seeing any other reports of this. Are you still experiencing these security passcode emails? If so, can you please share a screenshot of what they look like?

  • 0 in reply to Garmin - SP

    Thanks for the reply. No, it was just the two, a few hours apart, but with a password reset in between. I can't explain why I received them, and assume that a third party was trying to access my account, but I'd also have thought that the password would be required to elicit a passcode request. On that basis, if the password had been breached, then so had the replacement password. 

  • 0

     this has occurred to me 2x in the last two weeks or so.  My understanding of the login flow was a user had to provide a valid user / pass in order to trigger the 2FA email where the code is sent.  I randomly received a 2FA code in my inbox, immediately reset my password using a randomized password manager and stored it in a trusted password manager.  at 20:12 Z 9/24/2026 I received another 2FA code randomly in my inbox.  I do not have anything automated which would trigger an email flow, and the linked applications I have all use oauth I believe which would not trigger 2FA at all.  I have run malware scanners on my machine which returned a clean bill of health, however it'd be helpful to escalate this up to your engineering org to understand if this is a bug fix or those of us seeing this should be concerned that our machines are compromised.  I am not noticing this issue with other services I use with 2FA codes.

  • 0 in reply to 6305979

    When you have received a 2FA email, were you attempting to use a browser that had a tab opened with either the Forums or Garmin Connect web? 

    If "remember me" is checked and a previously used tab refreshes after being signed out, it will prompt a 2FA email or SMS to be sent. 

  • 0 in reply to Garmin - DC

    It's almost three months since my original post, and my memory isn't good enough to remember the exact sequence, but I did retain the original emails. I actually had three; the first was received at 10:55pm, and may quite possibly have been actually requested. I then received two more, at 12:24am and 3:54am. 

    If I DID request the one at 10:55, it's not impossible that it was on a tablet, on which I would probably have left the browser open, and the tablet booted. I wouldn't have been interacting with the device at those times, but I suppose it's not impossible that the page was reloaded - browser app update, for example. 

  • 0 in reply to simondaw

    Thank you for providing that update, since the initial post have you ran into this issue again?