Security notices and SMS

When something changes on a console account, Outpost tells the person whose account it is. These security notices go by email to the account’s address, and the three most serious also go by text message. They exist so that someone whose account was taken over hears about it, even when the change was made by whoever took it over.

Security notices are mandatory. There is no setting to turn them off, and they carry no unsubscribe link.

What triggers a notice

Notice	Sent when	Also by SMS
New sign-in to your account	Someone signs in from a device or network the account has not used before.	No
Your password was used to sign in	The correct password is entered from a new device or network on an account with two-factor authentication, and the sign-in is waiting for the second factor.	No
A password was set on your account	A password is set on an account that had none.	No
Your password was changed	The password is changed.	Yes
A password change was attempted on your account	Someone signed in to the account entered the wrong current password while changing it. Sent at most once an hour.	No
Your account email address was changed	The account’s email address is changed. Sent to the old address as well as the new one.	Yes
Two-factor authentication was turned on	Two-factor authentication is turned on.	No
Two-factor authentication was turned off	Two-factor authentication is turned off.	Yes
A recovery code was used to sign in	Someone signs in with a recovery code.	No
Your account permissions were changed	A role is granted or removed.	No
Your account was disabled	An administrator disables the account.	No
Your account was enabled	An administrator enables the account.	No

The console also emails invitations, sign-in codes, and the code that confirms a new email address. Those carry their own subject lines.

What a notice says

Every notice has the subject Security alert, so the subject line gives nothing away to someone who can see the recipient’s screen. The message contains:

• What happened, in one line, such as “Your password was changed”.
• Which account it is about: your organization’s name and the account’s email address.
• When it happened, in UTC, and the IP address and browser it came from, where known.
• The closing line “If this was you, no action is needed. If this was not you, secure your account now:” followed by a link to the Account page.

How notices are delivered

Notices go out through your organization’s active outgoing email provider. If that provider fails, Outpost retries the notice through its own mail service, from Outpost’s domain with your organization’s name on it, so a broken provider does not hide a warning about an account. Every notice is recorded, sent or not. See Configure outgoing email.

Text messages

Three changes also send a text message, because each one hands control of the account to whoever made it, and each can be made by someone who already controls the account’s mailbox:

• Your password was changed
• Your account email address was changed
• Two-factor authentication was turned off

A text message is sent only when all of these are true:

• The account has a phone number, and that number has been verified.
• Outpost’s text message service is available to your Outpost.

An email address change sends one text message, not two.

What to do with a notice you did not expect

• Change your password on the Account page.
• Turn on two-factor authentication if it is off.
• Read Recent activity on the same page for anything else you do not recognize.
• Tell an owner, so they can check the audit logs and, if needed, disable the account.

See Manage your console account.

Related

• Manage your console account
• Configure outgoing email
• Audit logs