An unexpected recovery message can be alarming, especially if it includes a code or says someone is trying to access your account. Treat it as a warning to check your account—not as a request you need to complete. Do not approve a recovery you did not start, and do not share its code with anyone. The message itself may be misleading, and clicking its links can take you somewhere other than the real sign-in page. Use a route you choose yourself, then take steps based on whether you can still access the account.
The useful bits
- Never approve an unrequested recovery or tell anyone its code.
- Open the official account site yourself rather than following a message link.
- For a managed mailbox, contact a trusted administrator through a known channel.
Pause before responding
Do not click buttons, scan codes, reply, or call numbers included in an unexpected recovery message. Do not enter a code into a page opened from that message. A real recovery code is meant to be used only in the recovery process you personally initiated; someone asking you to read it aloud or forward it should not receive it.
If a prompt appears on your phone or computer, deny it if you did not request it. If you are unsure whether you started a recovery, stop and check through the official account site instead. Do not assume the message is genuine just because it uses your name, an account address, or familiar branding.
Go to the account site on your own
Open a browser and type the official address yourself or use a bookmark you created previously. For BITTU Mail, sign-in, registration, account recovery, and account actions go through https://mail.bittuicloud.com. The public website is https://bittumail.tech, but do not use a link in the suspicious message as your route into an account.
Check the address shown in the browser before entering credentials or a code. If you cannot confidently reach the account page, stop rather than trying links from the message. From the official site, sign in if you can, or begin recovery there only if you need it. Use a fresh code only in the recovery flow you chose to start.
If you can still sign in, reduce exposure
A recovery message you did not request does not by itself prove that someone accessed your account. Still, if you suspect that your password or another sign-in detail was exposed, change the password through the official account actions. Choose a new, unique password and do not reuse one that may have been exposed elsewhere.
Review the account’s available security settings. Optional two-factor authentication may be available, but controls depend on the account and its provisioning state. If you can enable it, keep its recovery information private. Never give a password or one-time code to a person claiming to be support, an administrator, or the sender of the message.
If you cannot sign in
Start account recovery by navigating to the official site yourself, not by returning to the message. Follow the prompts there and enter a code only into the recovery process you initiated. If a code arrives after you begin, confirm that it relates to your current attempt; ignore unexpected codes that arrive at other times.
If recovery does not work, do not keep trying links or share codes with someone offering to fix it. For a personal account, use the account recovery options presented on the official site. For a work or other managed mailbox, contact a trusted administrator using a contact method you already know, such as a workplace directory or established communication channel.
Managed accounts need an administrator
An organisation’s administrator may control mailbox access and security settings. If a managed account receives an unexpected recovery message, tell the administrator what arrived and when, and whether you clicked a link, entered a password, or shared a code. Share the message details through a trusted channel; do not forward a code as proof.
Administrators should assess the account using the controls available to their role and workspace state. Workspace permissions and quotas are enforced server-side, and available controls can vary. If you are not an authorised administrator, do not attempt to inspect or change workspace settings yourself.
Check the outcome, then keep a short record
Confirm your response worked by returning independently to the official site and checking that you can sign in with your current credentials. If you changed a password or enabled an available security option, verify the change in the account settings presented to you. If access remains blocked, or you see account activity you cannot explain, continue through official recovery or contact the trusted administrator for a managed account.
Keep the message long enough to note its sender, time, and wording, especially if you need to report it. Do not preserve it by opening attachments or following links. Avoid declaring the account safe solely because the message stopped; focus on whether you regained access and completed the steps appropriate to your situation.
Unexpected message: “Your mailbox recovery code is [CODE]. Approve now.” Safer response: Do not approve or share [CODE]. Open https://mail.bittuicloud.com yourself. If you did not start recovery, do not enter the code. If this is a managed mailbox, contact [TRUSTED ADMINISTRATOR] through [KNOWN WORK CHANNEL] and explain what happened.
About this guide
Prepared with AI assistance for the BITTU Mail editorial library. Check important details against your original messages and current account settings. Product access depends on your role, plan and provisioning state. Provider interfaces and requirements can change.
View current plans · Security information · Suggest a correction