A one-time code can be rejected even when it arrives because the sign-in system may temporarily block or distrust the verification attempt. The documented causes include:
- Unusual activity detection after repeated sign-in or verification attempts.
- Too many code requests to the same phone or alternate method.
- Temporary protection blocks caused by compromised traffic from a geographic region.
- For Windows sign-in issues after updates, the update can also leave the PIN unavailable, which forces a new verification flow.
What to do when this happens:
- Stop repeated attempts. Repeated retries can extend the block.
- Try another verification method if one is available, such as another security method already on the account.
- Try another network by switching between Wi‑Fi and mobile data, or using a different Wi‑Fi network.
- Wait before retrying. A day may be enough; if not, wait longer, up to a week.
- If the PIN is unavailable after an update, on the sign-in screen select Sign-in options and use the password option if it appears. After signing in, go to Settings > Accounts > Sign-in options and reset the PIN.
- If already signed in later and the PIN needs to be changed or recreated, go to Settings > Accounts > Sign-in options > PIN (Windows Hello). Use Change PIN if the old PIN works, or I forgot my PIN if it does not.
To reduce the chance of this happening after a future update:
- Keep more than one verification method on the account so there is a fallback.
- Avoid requesting multiple codes in a short period.
- If unrequested codes are ever received, do not respond to them.
- Consider using passwordless options such as Windows Hello, Microsoft Authenticator, SMS/email codes, or a security key.
Important: changing all security info at the same time can restrict the account for 30 days.