My parents use AOL (there's no point trying to migrate them at this stage) with two factor authentication. My father let me know that he recently received an identity log in verification email that looks suspicious.
The resolved client location in the email my dad received is marked as Brazil, which would imply to me his password's compromised by someone routing through Brazil and we should rotate his password and review his security.
However, the verification email itself is a bit suspicious to me. Maybe I'm being paranoid, but I resurrected my old AOL account, which also has TFA, so that I could trigger a verification email to compare it. There are some odd variations I circled in red.
In the suspect email (left) there is no "name" in the salutation (maybe just bad email templating), and the verification code is 8 characters long. In my trusted verification email (right) the verification code is 4 characters. Also, my name appears in the salutation (though purposefully obfuscated).
Although I'm sure AOL could be using variable length codes, their challenge form specifies 4 characters even when I used a couple different browsers/devices. Maybe our accounts are flagged for different verification code lengths somehow, but I keep consistently getting 4 characters. I tried and failed to find any literature on pros/cons of variable verification code length or any official word on what length AOL uses.
The safe route seems to be to rotate his password and move on. However...
Is there anything possibly nefarious about the "suspicious" verification email?
The sender information, links, and overall formatting seem to imply the email is in fact legitimate. It's just weird to notice those irregularities.