Whenever you login to your account from an unknown device then AT&T ask you to enter verification code. Also, whenever AT&T notices any suspicious activity in your account it does ask to enter verification code to give access to your account. So, when AT&T is taking so much care of your account then why are you not following all safety guideline suggested by AT&T. Follow practice of AT&T mail password reset regularly to avoid any phishing activity in your account and protect your account from shoulder surfers. To know as how to reset account password if you are not aware of call to AT&T customer care team.