Gave someone a verification code? Do this now.
Change the affected password from a trusted device. Then check recent activity and secure your email, banking, and payment accounts.
Important
A real company does not need you to read a one-time code back to them. The company already generated the code.
Do this now
- Stop communicating with the person who asked for the code.
- Use a trusted device, not a device someone else controls.
- Change the password for the account the code belonged to.
- Check recent activity, login history, payment methods, forwarding rules, and recovery email or phone settings.
- Sign out of other sessions if the account gives you that option.
- Turn on extra security, such as an authenticator app, if the service offers it.
- Secure your email and financial accounts too, especially if you reuse passwords.
If you do not know what account the code was for
Start with the account named in the message or call. If no account was named, secure your email first, then your bank, payment apps, phone account, and any account that recently sent you a code.
If money or identity information was also involved
If you sent money, shared a banking login, shared your Social Security number, or gave remote access too, use the full recovery page for the next branch.
What not to do
Don't do this
- Do not read another code to anyone who calls or texts.
- Do not click a link from the person who asked for the code.
- Do not change passwords while a stranger is still on the phone or watching your screen.
- Do not assume the account is safe just because you can still log in.
Common questions
What happens if I gave someone my verification code?
They may be trying to get into one of your accounts. Change the password for that account from a trusted device, check recent activity, and secure your email and financial accounts too.
Which account should I secure first?
Secure the account that sent the code first. If you are not sure which account it was, start with your email, bank, payment apps, phone account, and any account mentioned by the caller or text.
Should I tell the company?
Yes. Contact the real company through its official app or website and say someone may have used a verification code to access your account.
Sources
-
Regulator alert
What's a verification code and why would someone ask me for it?
-
Regulator guidance
Recognize and Report Phishing
-
Federal reporting portal
IdentityTheft.gov