My sign-in link says it has already been used

You have not done anything wrong

If you asked for a sign-in link and got “that link has already been used” on your first click, the usual cause is not you.

Many companies run security software — Microsoft Defender Safe Links, Proofpoint, Barracuda and others — that opens every link in an incoming email to check it is safe. That happens minutes before you see the message. To our system, that looks exactly like somebody clicking your link.

Use the code instead

Every sign-in email we send contains a six-digit code as well as a link:

Or enter this code: 418902

Go back to the sign-in page, choose “Email me a sign-in link”, and the box for the code appears underneath. Type the six digits from the email.

Already have a code and you are on a different browser or device? Use the “Already have a code? Enter it here” link under the sign-in form. It asks for your email address as well, because this browser has not seen it — and it saves you asking for a new code, which would cancel the one you already have.

Nothing your mail scanner does can affect the code, because it has to be typed. That is the whole reason it is there.

A few things worth knowing:

• The code lasts 20 minutes — the same as the link. Ask for a new one if it runs out.
• The box stays open. Refresh the page, mistype a digit, come back later — the box is still there, with your address already filled in, until the code expires. You do not need to ask for another one, and asking for another one cancels the one in your email.
• You get five tries. After that the code stops working and you will need a fresh one — so copy it carefully rather than guessing.
• Spaces do not matter. 418 902, a leading space, even a dash — we read the digits.
• It only works on the page you asked for it from, on the same site.

If the code does not arrive either

Check your spam folder, and add us to your safe senders — that is also where your join links and certificates end up.

Some mail systems delay forwarded addresses by several minutes. If you use an address that forwards somewhere else, wait a little longer before asking for another; each new request replaces the last code.

For your IT team

If this happens to your whole firm, your administrator can exempt our sign-in address from URL scanning. In Microsoft 365 that is the Safe Links policy’s Do not rewrite the following URLs list. It is optional — the code works regardless — but it makes the links behave normally again.

Still stuck

Contact us and say that your sign-in link reports itself as already used. That tells us immediately what is happening, and we can get you in another way.