Security Emails

A vs B emails you whenever something changes that affects who can sign in to your account. Most of the time the email is simply a record: you did the thing, and the email confirms it.

The one that matters is the email you did not expect. That is your earliest warning that someone else has reached your account, or that A vs B acted on it. This page tells you what each email means and exactly what to do about a surprise.

Every one of these emails goes to the address registered on your account, and none of them ever asks you to reply with a password or a code.

The emails you may receive

A code to finish signing in. Sent every time you log in while two-factor authentication is turned on, titled "Your A vs B login code". The code is six digits, works once, and expires after 10 minutes. See Two-Factor Authentication.

A code to confirm two-factor authentication. Sent when you turn two-factor authentication on, titled "Confirm two-factor authentication". Typing it in proves the codes reach you before sign-in starts asking for them. If you did not try to turn 2FA on, someone else may be signed in as you: change your password.

A code to confirm your email address. Sent when you first sign up. Confirming proves the address reaches you, which matters because it is where every other email on this page will go.

A link to reset your password. Sent only when someone asks to reset the password for your address. If you did not ask, nothing has changed yet: the link has to be opened before anything happens. See Changing Your Password.

A notice that two-factor authentication was turned off. Sent when A vs B switches the second step off for you, which normally happens after you ask support for help getting back into your account. Your password still works, but signing in no longer asks for a code, so turn it back on from Account Settings → Security as soon as you are in. You will not get this email when you turn 2FA off yourself, because you already know.

A notice that your account was locked. A locked account cannot sign in at all. A vs B locks an account when there is a security concern about it, or when you ask us to. The email means you are not left guessing at a login screen that will not let you through. The login page also says the account is locked and to contact support.

This is not the short pause after five wrong passwords in a row. That pause sends no email: the login page says how many minutes are left, and resetting your password ends it at once. See If sign-in is paused.

A notice that your account was unlocked. The all clear. Signing in works again from that moment.

If you did not expect one of these

Treat an unexpected security email as real until you have checked. Work through these in order.

What A vs B will never do

Your inbox is the key to your account

Both of the ways back into an A vs B account you cannot sign in to lead to the same place: your email inbox. Forget your password and the reset link is emailed to you. Turn on two-factor authentication and the sign-in code is emailed to you as well.

That is convenient, and it has one consequence worth knowing. Anyone who can read your email can do both of those steps one after the other. Your inbox is not just another account, it is the master key to this one.

So the single most useful thing you can do to protect your A vs B account is to protect the inbox it is registered to:

• Use a strong, unique password on the email account itself.
• Turn on the strongest second step your email provider offers, ideally an authenticator app or a security key rather than a code by text message.
• Check who else can read that inbox. Shared team addresses, forwarding rules and access you granted an assistant or an old colleague all count.
• Prefer an address only you can read. If your A vs B account is registered to a shared address such as a team alias, consider moving it to your own.
• Keep the address reachable. If you lose access to it, you lose both routes back in.