[No QA] Update help docs with proportionate guidance for unrequested magic codes#88662
Conversation
Update both New Expensify and Expensify Classic "Avoiding common scams" help articles to include a new section for users who receive a magic code they didn't request. The new guidance reassures users that an unrequested code alone doesn't mean their account is compromised, reminds them not to share the code, and reserves the "lock your account" recommendation for cases where the code was actually shared or the user's email is believed to be compromised. Co-authored-by: David Barrett <quinthar@users.noreply.github.com>
github-actions
Bot
changed the title
|
A preview of your ExpensifyHelp changes have been deployed to https://688dc944.helpdot.pages.dev ⚡️ Updated articles: |
Concierge reviewer checklist:
For more detailed instructions on completing this checklist, see How do I review a HelpDot PR as a Concierge Team member? |
|
@RachCHopkins Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
HelpDot Documentation ReviewOverall AssessmentThis PR makes meaningful improvements to both "Avoiding common scams" articles by adding proportionate guidance for unrequested Magic Codes, removing legacy Recommendation: Request Changes -- the issues below are straightforward to fix. Scores Summary
What is done well
Issues foundCritical
Medium
Low
Recommendations
Files Reviewed
Review based on docs/HELP_AUTHORING_GUIDELINES.md, docs/HELPSITE_NAMING_CONVENTIONS.md, and docs/TEMPLATE.md governance standards. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0def5a7c04
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| If you accidentally gave someone your Magic Code, act fast: | ||
|
|
||
| 1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access. | ||
| 1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access. |
There was a problem hiding this comment.
Cross-linking violation: Links must not be placed inside numbered step instructions (per HELP_AUTHORING_GUIDELINES.md Section 7 - Link Formatting). Move this link outside the numbered steps — e.g., add a separate sentence after the list: Learn how to lock your Expensify account.
| If you believe your account has been targeted or compromised: | ||
|
|
||
| 1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access. | ||
| 1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access. |
There was a problem hiding this comment.
Cross-linking violation: Links must not be placed inside numbered step instructions. Move this link outside the numbered steps.
| If you accidentally gave someone your Magic Code, act fast to: | ||
|
|
||
| 1. **[Lock your Expensify account](https://help.expensify.com/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access. | ||
| 1. **[Lock your Expensify account](/articles/expensify-classic/settings/Report-Suspicious-Activity)** immediately to block unauthorized access. |
There was a problem hiding this comment.
Cross-linking violation: Links must not be placed inside numbered step instructions (per HELP_AUTHORING_GUIDELINES.md Section 7 - Link Formatting). Move this link outside the numbered steps — e.g., add a separate sentence after the list.
Additionally, this is a New Expensify article but the link points to an Expensify Classic article (/articles/expensify-classic/settings/Report-Suspicious-Activity). If a New Expensify equivalent exists, link to that instead.
HelpDot Documentation ReviewOverall AssessmentThis PR adds proportionate guidance for unrequested Magic Codes across both Expensify Classic and New Expensify versions of the "Avoiding common scams" article. The changes improve structure by flattening nested headings (### to ##), add the required Scores Summary
Key FindingsPositive aspects:
Issues to address:
Recommendations
Files Reviewed
|
|
Applied all relevant bot comments! |
|
@RachCHopkins looks like this was merged without a test passing. Please add a note explaining why this was done and remove the |
|
|
||
| 1. **Do not share the code with anyone** — simply ignore or delete the email. | ||
| 2. **Do not click any links** in the email. | ||
| 3. **Consider enabling [two-factor authentication](https://help.expensify.com/articles/new-expensify/settings/Two-Factor-Authentication)** for extra account security. |
There was a problem hiding this comment.
Link formatting violation: Use a relative link instead of a full URL. Per cross-linking standards, all links must be relative.
| 3. **Consider enabling [two-factor authentication](https://help.expensify.com/articles/new-expensify/settings/Two-Factor-Authentication)** for extra account security. | |
| 3. **Consider enabling [two-factor authentication](/articles/new-expensify/settings/Two-Factor-Authentication)** for extra account security. |
| ## What to do if you shared your Magic Code | ||
|
|
||
| If you accidentally gave someone your Magic Code, act fast: | ||
| If you accidentally gave someone your Magic Code, act fast to: |
There was a problem hiding this comment.
Readability issue: The sentence "act fast to:" creates a grammatically incomplete lead-in — the numbered list items that follow are not continuations of that phrase. Consider matching the phrasing used in the Expensify Classic version: "act fast:"
| If you accidentally gave someone your Magic Code, act fast to: | |
| If you accidentally gave someone your Magic Code, act fast: |
|
|
||
| 1. **Do not share the code with anyone** — simply ignore or delete the email. | ||
| 2. **Do not click any links** in the email. | ||
| 3. **Consider enabling [two-factor authentication](/articles/expensify-classic/settings/Two-Factor-Authentication)** for extra account security. |
There was a problem hiding this comment.
Cross-linking violation: Links should not be placed inside numbered step instructions. Per the authoring guidelines: "Do not place links inside numbered step instructions. Do not interrupt procedural flow with inline links." Move the two-factor authentication link after the numbered list instead.
This also applies to steps 1 and 3 at lines 75 and 77.
|
|
||
| 1. **Do not share the code with anyone** — simply ignore or delete the email. | ||
| 2. **Do not click any links** in the email. | ||
| 3. **Consider enabling [two-factor authentication](https://help.expensify.com/articles/new-expensify/settings/Two-Factor-Authentication)** for extra account security. |
There was a problem hiding this comment.
Cross-linking violation: Links should not be placed inside numbered step instructions. Per the authoring guidelines: "Do not place links inside numbered step instructions. Do not interrupt procedural flow with inline links." Move the two-factor authentication link after the numbered list instead.
This also applies to steps 1 and 3 at lines 76 and 78.
|
|
||
| Legitimate Expensify emails always come from an address ending in **@expensify.com** or **@team.expensify.com**. If you’re unsure, don’t click any links — just log into the Expensify app directly and message Concierge. | ||
|
|
||
| ## I received a Magic Code I didn't request. Is my account compromised? |
There was a problem hiding this comment.
Heading rule violation: All ## headings must start with an action verb or question word (How, What, Where, Who, Why, When). "I received a Magic Code I didn't request. Is my account compromised?" starts with "I" instead. Consider rephrasing:
| ## I received a Magic Code I didn't request. Is my account compromised? | |
| ## What to do if I received a Magic Code I didn't request |
|
|
||
| Legitimate Expensify emails always come from an address ending in **@expensify.com** or **@team.expensify.com**. If you’re unsure, don’t click any links — just log into the Expensify app directly and message Concierge. | ||
|
|
||
| ## I received a Magic Code I didn't request. Is my account compromised? |
There was a problem hiding this comment.
Heading rule violation: All ## headings must start with an action verb or question word (How, What, Where, Who, Why, When). "I received a Magic Code I didn't request. Is my account compromised?" starts with "I" instead. Consider rephrasing:
| ## I received a Magic Code I didn't request. Is my account compromised? | |
| ## What to do if I received a Magic Code I didn't request |
HelpDot Documentation ReviewOverall AssessmentThis PR makes meaningful improvements to both "Avoiding common scams" articles. The changes add a valuable new section for unrequested Magic Codes, fix heading hierarchy (removing ### in favor of ##), add required Scores Summary
Key FindingsMust fix:
Should fix:
Positive aspects:
Recommendations
Files Reviewed
Review based on governance files: HELP_AUTHORING_GUIDELINES.md, HELPSITE_NAMING_CONVENTIONS.md, and TEMPLATE.md. |
|
🚀 Deployed to staging by https://github.com/RachCHopkins in version: 9.3.62-5 🚀
Bundle Size Analysis (Sentry): |
|
🚀 Deployed to staging by https://github.com/RachCHopkins in version: 9.3.64-0 🚀
Bundle Size Analysis (Sentry): |
4 participants
Explanation of Change
The current "Avoiding common scams" help articles recommend users immediately lock their account for any security concern, including receiving an unrequested magic code. This is disproportionate — receiving an unexpected code simply means someone mistyped their email, not that the account is compromised. Locking accounts creates manual KYC/unlock work for the support team.
This PR adds a new "What to do if you receive a magic code you didn't request" section to both the New Expensify and Expensify Classic versions of the article. The new guidance:
A corresponding FAQ entry is also added to both articles.
Fixed Issues
$ #88661
Tests
// TODO: The human co-author must fill out the tests you ran before marking this PR as "ready for review"
// Please describe what tests you performed that validates your changed worked.
Offline tests
N/A — documentation-only change.
QA Steps
// TODO: The human co-author must fill out the QA tests you ran before marking this PR as "ready for review".
// Please describe what QA needs to do to validate your changes and what areas do they need to test for regressions.
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectiontoggleReportand notonIconClick)src/languages/*files and using the translation methodSTYLE.md) were followedAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.ScrollViewcomponent to make it scrollable when more elements are added to the page.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Android: Native
N/A — documentation-only change.
Android: mWeb Chrome
N/A — documentation-only change.
iOS: Native
N/A — documentation-only change.
iOS: mWeb Safari
N/A — documentation-only change.
MacOS: Chrome / Safari
N/A — documentation-only change.