Merge pull request Expensify#88662 from Expensify/claude-updateUnrequestedMagicCodeGuidance

[No QA] Update help docs with proportionate guidance for unrequested magic codes

Author: RachCHopkins

docs/articles/expensify-classic/settings/Avoiding-common-scams.md

@@ -2,14 +2,16 @@
 title: Avoiding common scams
 description: Learn how to recognize and avoid common phishing scams that pretend to be from Expensify, including fake phone calls and emails asking for your Magic Code.
 keywords: [Expensify scam, phishing, Magic Code, security, login code, avoid fraud, suspicious email, fake call, fraud prevention]
+internalScope: Audience is all Expensify members. Covers identifying and responding to scams involving Magic Codes. Does not cover account recovery or dispute workflows.
 ---
-<div id="expensify-classic" markdown="1">
 
-# How to avoid scams pretending to be from Expensify
+# Avoiding common scams
 
 Some scammers try to impersonate Expensify by sending fake emails or calling you directly, often asking for your **Magic Code** (your login code). These scams are designed to trick you into giving up access to your Expensify account.
 
-This guide explains what these scams look like, how to spot them, and what to do if you think you've been targeted.
+This article explains how these scams work, how to recognize them, and what actions to take.
+
+**Note:**  Expensify will never call you asking for login codes, passwords, or payment information. If you receive such a call, it's a scam.
 
 ---
 
@@ -21,21 +23,17 @@ The **Magic Code** is a one-time login code Expensify emails or texts to you whe
 
 ---
 
-## Common scams to watch out for
-
-Here are the most common types of scams we've seen targeting Expensify members:
-
-### 1. Phone call scams requesting your Magic Code
+## How to recognize phone call scams pretending to be Expensify
 
 - The scammer claims to be from Expensify and needs your Magic Code to verify your account.
 - They may spoof a legitimate phone number to make it seem more convincing.
 - Some scammers may create a sense of urgency (e.g., “We detected suspicious activity on your account.”)
 
-**If someone calls you asking for your Magic Code, hang up immediately.**
+**If you receive this type of call, hang up.**
 
 ---
 
-### 2. Phishing emails and texts requesting you use their link to login to Expensify
+## How to recognize phishing emails or texts pretending to be Expensify
 
 - Emails and text messages often look like they’re from Expensify or Visa, but the sender address is likely not from an expensify.com email address.
 - These emails and text messages may have links that lead to a fake login page, prompt you to reset your password, or ask you to reply with your Magic Code.
@@ -45,32 +43,46 @@ Here are the most common types of scams we've seen targeting Expensify members:
 
 ---
 
-## How to stay safe
-
-Here’s how you can protect your Expensify account:
+## How to protect your Expensify account
 
 - **Never share your Magic Code** — not over the phone, not by email, not via text.
 - **Don’t click suspicious links** — always verify the sender’s email address.
-- **Use 2FA** (two-factor authentication) to add an extra layer of security.
-- **If in doubt, message Concierge** directly from within the Expensify app.
+- **Use two-factor authentication (2FA)** - this adds an extra layer of security to your account. 
+- **If in doubt, message Concierge**  - reach out directly from within the Expensify app.
+
+[Learn how to enable two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication). 
+
+---
+
+## What to do if you receive a Magic Code you didn't request
+
+If you receive a Magic Code email but didn’t try to log in, this does not necessarily mean your account has been compromised. It can happen for a variety of reasons, such as someone mistyping an email address. 
+
+Here's what to do:
+
+1. **Do not share the code with anyone** — simply ignore or delete the email.
+2. **Do not click any links** in the email. 
+3. **Consider enabling [two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication)** for extra account security.
+
+**Note:** You do not need to lock your account just because you received an unexpected Magic Code. Only lock your account if you believe someone has gained access to your email account or if you shared your Magic Code with someone.
 
 ---
 
 ## What to do if you shared your Magic Code
 
 If you accidentally gave someone your Magic Code, act fast:
 
-1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
+1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
 2. **Contact Concierge** from a safe device and explain the situation.
-3. **[Enable two-factor authentication](https://help.expensify.com/articles/expensify-classic/settings/Two-Factor-Authentication)** to protect your account going forward.
+3. **[Enable two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication)** to protect your account going forward.
 
 ---
 
 ## How to report phishing and lock your account
 
 If you believe your account has been targeted or compromised:
 
-1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
+1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
 2. **Message Concierge immediately** via [email](mailto:concierge@expensify.com), or from within the Expensify app (web or mobile).
 3. Let us know if you’ve received a suspicious message or phone call.
 4. Our team will work to secure your account.
@@ -90,9 +102,12 @@ Expensify uses Magic Codes instead of passwords to simplify login while keeping
 
 Legitimate Expensify emails always come from an address ending in **@expensify.com** or **@team.expensify.com**. If you’re unsure, don’t click any links — just log into the Expensify app directly and message Concierge.
 
+## I received a Magic Code I didn't request. Is my account compromised?
+
+No. Receiving an unrequested Magic Code does not mean your account is compromised. It most likely means someone entered your email address by mistake when trying to log in. As long as you don't share the code with anyone, your account is safe. You can simply ignore or delete the email. If you want extra protection, enable [two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication).
+
 ## Can Expensify call me?
 
 Expensify will **never** call you asking for login codes, passwords, or payment information. If you receive such a call, it's a scam.
 
-</div>
 

docs/articles/new-expensify/settings/Avoiding-common-scams.md

@@ -2,16 +2,17 @@
 title: Avoiding common scams
 description: Learn how to recognize and avoid common phishing scams that pretend to be from Expensify, including fake phone calls and emails asking for your Magic Code.
 keywords: [Expensify scam, phishing, Magic Code, security, login code, avoid fraud, suspicious email, fake call, fraud prevention]
+internalScope: Audience is all Expensify members. Covers identifying and responding to scams involving Magic Codes. Does not cover account recovery or dispute workflows.
 ---
 
-<div id="new-expensify" markdown="1">
 
-
-# How to avoid scams pretending to be from Expensify
+# Avoiding common scams
 
 Some scammers try to impersonate Expensify by sending fake emails or calling you directly, often asking for your **Magic Code** (your login code). These scams are designed to trick you into giving up access to your Expensify account.
 
-This guide explains what these scams look like, how to spot them, and what to do if you think you've been targeted.
+This article explains how these scams work, how to recognize them, and what actions to take.
+
+**Note:**  Expensify will never call you asking for login codes, passwords, or payment information. If you receive such a call, it's a scam.
 
 ---
 
@@ -23,21 +24,17 @@ The **Magic Code** is a one-time login code Expensify emails or texts to you whe
 
 ---
 
-## Common scams to watch out for
-
-Here are the most common types of scams we've seen targeting Expensify members:
-
-### 1. Phone call scams requesting your Magic Code
+## How to recognize phone call scams pretending to be Expensify
 
 - The scammer claims to be from Expensify and needs your Magic Code to verify your account.
 - They may spoof a legitimate phone number to make it seem more convincing.
 - Some scammers may create a sense of urgency (e.g., “We detected suspicious activity on your account.”)
 
-**If someone calls you asking for your Magic Code, hang up immediately.**
+**If you receive this type of call, hang up.**
 
 ---
 
-### 2. Phishing emails and texts requesting you use their link to login to Expensify
+## How to recognize phishing emails or texts pretending to be Expensify
 
 - Emails and text messages often look like they’re from Expensify or Visa, but the sender address is likely not from an expensify.com email address.
 - These emails and text messages may have links that lead to a fake login page, prompt you to reset your password, or ask you to reply with your Magic Code.
@@ -47,32 +44,46 @@ Here are the most common types of scams we've seen targeting Expensify members:
 
 ---
 
-## How to stay safe
-
-Here’s how you can protect your Expensify account:
+## How to protect your Expensify account
 
 - **Never share your Magic Code** — not over the phone, not by email, not via text.
 - **Don’t click suspicious links** — always verify the sender’s email address.
-- **Use 2FA** (two-factor authentication) to add an extra layer of security.
-- **If in doubt, message Concierge** directly from within the Expensify app.
+- **Use two-factor authentication (2FA)** - this adds an extra layer of security to your account. 
+- **If in doubt, message Concierge**  - reach out directly from within the Expensify app.
+
+[Learn how to enable two-factor authentication](/articles/new-expensify/settings/Two-Factor-Authentication#how-to-enable-two-factor-authentication). 
+
+---
+
+## What to do if you receive a Magic Code you didn't request
+
+If you receive a Magic Code email but didn’t try to log in, this does not necessarily mean your account has been compromised. It can happen for a variety of reasons, such as someone mistyping an email address. 
+
+Here's what to do:
+
+1. **Do not share the code with anyone** — simply ignore or delete the email.
+2. **Do not click any links** in the email. 
+3. **Consider enabling [two-factor authentication](https://help.expensify.com/articles/new-expensify/settings/Two-Factor-Authentication)** for extra account security.
+
+**Note:** You do not need to lock your account just because you received an unexpected Magic Code. Only lock your account if you believe someone has gained access to your email account or if you shared your Magic Code with someone.
 
 ---
 
 ## What to do if you shared your Magic Code
 
-If you accidentally gave someone your Magic Code, act fast:
+If you accidentally gave someone your Magic Code, act fast to: 
 
-1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
+1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
 2. **Contact Concierge** from a safe device and explain the situation.
-3. **[Enable two-factor authentication](https://help.expensify.com/articles/new-expensify/settings/Two-Factor-Authentication)** to protect your account going forward.
+3. **[Enable two-factor authentication](/articles/new-expensify/settings/Two-Factor-Authentication)** to protect your account going forward.
 
 ---
 
 ## How to report phishing and lock your account
 
 If you believe your account has been targeted or compromised:
 
-1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
+1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access.
 2. **Message Concierge immediately** via [email](mailto:concierge@expensify.com), or from within the Expensify app (web or mobile).
 3. Let us know if you’ve received a suspicious message or phone call.
 4. Our team will work to secure your account.
@@ -92,8 +103,11 @@ Expensify uses Magic Codes instead of passwords to simplify login while keeping
 
 Legitimate Expensify emails always come from an address ending in **@expensify.com** or **@team.expensify.com**. If you’re unsure, don’t click any links — just log into the Expensify app directly and message Concierge.
 
+## I received a Magic Code I didn't request. Is my account compromised?
+
+No. Receiving an unrequested Magic Code does not mean your account is compromised. It most likely means someone entered your email address by mistake when trying to log in. As long as you don't share the code with anyone, your account is safe. You can simply ignore or delete the email. If you want extra protection, enable [two-factor authentication](/articles/new-expensify/settings/Two-Factor-Authentication).
+
 ## Can Expensify call me?
 
 Expensify will **never** call you asking for login codes, passwords, or payment information. If you receive such a call, it's a scam.
 
-</div>