Sign-in links, codes, and email-change messages go to your mailbox; “sent” on a page does not prove delivery.
- Request a sign-in link for your registered email at /login and open only a link you receive yourself.
- If you have set a passkey, authenticator, or recovery code, retain at least one of them instead of depending on a message that has not arrived.
- To change email, sign in and complete the confirmation required at /account/security. Never forward a code, sign-in link, or recovery code.
Evidence
GET /login=200GET /account/security=302; Location=/account#securityauthenticated GET /account=200 is a separate server-verified session factmail delivery E2E has no independent observation window