When OpenAI sends a temporary verification code because someone is attempting to sign in or create an account using my email address, the email currently contains only the verification code.
It would be much more useful and security-transparent if the message also included basic information about the login attempt, for example:
Date and exact time of the attempt, including time zone
Approximate geographic location
IP address
Browser / operating system or device information, where available
Whether the attempt was a sign-in or account-creation attempt
This is a common security feature at many other services and makes it immediately possible for the recipient to determine whether the authentication request was likely initiated by them.
This is particularly important when an email address is entered accidentally, is being used by somebody else, or is being targeted by automated sign-up/login attempts. Without any contextual information, the recipient cannot distinguish between a legitimate authentication request and an unsolicited attempt.
In my particular case, I received numerous genuine OpenAI verification emails over several days, including multiple attempts during the night. The emails were legitimate and came from OpenAI, but contained no information whatsoever about the origin of the requests. Only by independently testing the address did I discover that these were repeated account-creation attempts using an unrelated email address, rather than attempts against my actual ChatGPT account.
Adding the originating information to the verification email would have made this immediately apparent.
Ideally, the email should provide enough information to answer a simple question at a glance:
“Was this authentication attempt made by me?”
This would significantly improve both security awareness and the usefulness of OpenAI’s authentication notifications.