Unexpected Verification Code Emails

1. How does Salesforce protect your account?

When someone attempts to log in to welcome.salesforce.com with an email address that is associated with multiple Salesforce orgs, a browser verification email is sent to that the user. This process does not require a password but relies on access to the user’s email account for verification. To proceed, the user must log in to the email account, retrieve the verification code, and enter the code in welcome.salesforce.com. This is done so that only users who prove ownership of the email are allowed to view the orgs associated with the email.

2. What to do if you receive an email you did not initiate verification for?

Users may receive emails that they didn’t initiate from welcome.salesforce.com with the subject, “Here’s your verification code.” These emails validate a new user when they first log in to welcome.salesforce.com. To generate this email, no private information must be used, so there is no information exposed to unauthorized users. As it says at the bottom of the email, "If you haven't requested this email, you can safely ignore it."