WHAT TO DO WHEN RECEIVING UNPROMPTED MFA OTP CODES

Summary from the TLDR InfoSec newsletter

This article discusses what to do after receiving an unprompted MFA OTP code. Assume that the credentials for the site have been compromised and reset passwords for affected sites. Do not click any links in such messages and go directly to the site's URL.