We extend the seminal work by Polyanskiy (2017) on massive uncoordinated access to the case where the number of active users is random and unknown a priori. We define a random-access code accounting for both misdetection (MD) and false alarm (FA), and derive a random-coding achievability bound for the Gaussian multiple-access channel. Our bound captures the fundamental trade-off between MD and FA probabilities. The derived bound suggests that, for the scenario considered in Polyanskiy (2017), lack of knowledge of the number of active users entails a small penalty in terms of power efficiency. For example, our bound shows that 0.5-0.7 dB extra power is required to achieve both MD and FA probabilities below 0.1 compared to the case in which the number of active users is known a priori. Taking both MD and FA into account, we show that some of the recently proposed massive random access schemes are highly suboptimal with respect to our bound.