Is it safe to enter an activation code?

Safe, by definition

A legitimate activation code is created by the device in front of you, expires after a short time, and only works on the official activation page. Typing it there links your own device to your own account. There is nothing sensitive to steal in the code, and entering it never shares your password with the TV. If you want to know why it is built this way, see what an activation code is.

The three-question check

Before you type any code, answer three questions. If all three are yes, go ahead.

1. Did I start this myself? You opened the app and chose to sign in a moment ago, on a device you can see.
2. Is the code on my own screen? The code came from that device, not from an email, text, chat message, phone call or website.
3. Am I on the official site? You typed the address shown on your TV, or scanned the QR code on your own screen, and the page is on the service's own domain.

Red flags that mean "stop"

• A fee to activate. Activation is always free. Any page asking for payment, a subscription "to activate", a gift card or a card number "to verify" is a scam.
• Someone asks you for the code. No real company calls, texts or emails to ask you to read out an activation code. Giving it away can let a stranger finish the sign-in first.
• A web address that is not the official one. Type the address your device shows. Do not trust ads, sponsored search results or links in emails that look slightly off.
• A request for remote access. You never need to install "support" software or let anyone control your screen to activate an app.
• A password box on the code screen of a site you did not type in. Sign in only on the service's own page, then enter the code.
• A support number or chat that appears on an "activation help" site. Activation needs no helper. Use the service's official help pages if you are stuck.

The newer trick: approving someone else's code

Most people know not to share a code. Fewer know about the reverse. A scammer starts a sign-in on their own device, which shows them a genuine code, then sends that code to you with a believable message, such as "enter this code to keep your account active" or "to join the meeting". The page you are sent to is real, which is what makes it convincing. If you sign in and enter their code, you have just approved their device on your account.

This is known as device code phishing. Microsoft's security team described an active device code phishing campaign in February 2025, and the standard behind code sign-in, RFC 8628, lists remote phishing as a known risk and recommends that services show what device you are approving. The defence is simple: never enter a code that was sent to you, and read the confirmation screen. If it names a device or app you are not setting up right now, cancel. More background in device code sign-in, explained.

Shared and public screens

On a hotel, holiday-rental or office TV, other people may be able to see the code while it is on screen. The same standard notes that someone watching could, in theory, enter it faster than you. Enter the code promptly, check the confirmation, and sign out before you leave. Our guide to streaming on a hotel TV safely walks through it, and a pairing code or casting option can avoid signing in on that TV at all.

If you already entered a code or paid a fake site

1. Remove unknown devices. In your account on the service's own website, sign out of devices you do not recognise, or sign out of all devices. See how to sign out of all devices.
2. Change your password for that service, and anywhere else you used the same one. Turn on two-step verification if the service offers it.
3. If you paid or gave card details, contact your bank or card issuer using the number on the back of your card, and ask about disputing the charge.
4. If you allowed remote access, uninstall the software, disconnect the computer from the internet, and run a security scan before signing in to anything else.
5. Report it. In the United States, report the fraud at ReportFraud.ftc.gov and internet crime at IC3.gov. Elsewhere, use your national fraud reporting service.

Afterwards, unexpected sign-outs on your own TVs are normal, because changing a password usually ends other sessions; why your TV keeps signing you out explains how to sign back in cleanly.

See also: activate without a code, scanning a QR code safely and too many devices errors, which can be a sign that someone else is using your account.