[Help] Email compromised, account opened on Marcus.

The fact that a stranger's phone can receive verification codes is quite significant—it suggests they not only know your email but may already have partial control over the account flow. Also, you've enabled two-factor authentication yet aren't receiving the codes, which is suspicious in itself. I'd recommend first checking your Gmail login activity and forwarding rules.

You said you didn't receive the verification code in your inbox—have you also checked your spam folder and the "All Mail" label?

Start by using Gmail's "Security Checkup" to look for any unusual sign-ins or authorized apps, then contact Marcus customer service directly to explain that your email is being used and ask them to freeze or close that account. The key is being able to prove the email belongs to you, so have your registration date and records showing two-factor authentication was enabled ready—it'll make the conversation much more effective.

Look at it from another angle: whoever opened a Marcus account with your email may be trying to link your credit history or Apple Card information to their identity, not just squatting on the address. If that account later sees activity, the chain of accountability could loop back to you, so beyond changing your password, it's also worth asking Marcus whether they can note that the email was used without authorization.