What Should You Do about an Authentication Code You DIDN’T Request?