Someone who contacted you asks for a sign-in code.
A scammer may use the code to enter your account. End the call or chat and contact the company through its official app or a number you already trust.
Someone wants a verification code
You receive a text or call asking you to read back a one-time passcode, security code, or "verification code" that was just sent to your phone.
Being pressured right now?
Hang up now. You do not have to explain. Call back using a number you find yourself. — from a bank card, a billing statement, or the official website you type in yourself. Do not use a number the caller gave you, texted you, or that appears on your caller ID.
If you read nothing else
If you read nothing else:
- Stop communicating, and do not move money, pay, or share codes while you are under pressure.
- Someone who contacted you asks for a sign-in code.
- Do not read a verification code to anyone who calls or texts you, even if they claim to be from a company you use.
Why this is a red flag
You receive a code you did not request.
It may be an account access attempt, but the code alone does not prove someone has your password. For example, Login.gov says someone may have entered the wrong phone number.
The request is paired with urgency, like a "locked account" or "suspicious login" warning.
Scammers pair the code request with a reason that sounds official so you act fast instead of pausing.
What to do right now
Do this now
- Do not share a sign-in code with someone who contacts you.
- If you did not request the code, change the password on that account using the official app or website.
- Turn on additional account security (like an authenticator app) if the service offers it.
- Contact the real company directly through its official app or website if you are unsure what triggered the code.
What not to do
Don't do this
- Do not read a verification code to anyone who calls or texts you, even if they claim to be from a company you use.
- Do not enter a code into a link sent to you by text or email.
- Do not assume a caller is legitimate because they already know your name, address, or part of an account number.
What to save
What to save
- A screenshot of the code text and any message asking for it.
- The phone number or account the request claimed to come from.
- The date and time you received the unsolicited code.
Common questions
Why would someone ask me for my verification code?
A scammer who contacts you may use the code to enter your account or link a new account to your phone number. Do not share it. Check with the company through its official app or a number you already trust.
Should I read a sign-in code to someone who calls me?
No. Do not share a verification code with anyone who calls or texts you, even if they already know your name, address, or part of an account number.
What do I do if I already gave out my code?
From a trusted device, change the password on that account right away using the official app or website, and turn on extra security like an authenticator app if it is offered.
Does an unexpected code mean someone has my password?
Not necessarily. It may be an account access attempt or a wrong phone number. Do not share the code. Open the official app or website yourself, check account activity, and change your password if you suspect a problem.
Where to go next
If you already sent money, shared a code, or gave access to something, go to what to do now for next steps by what happened. If money, access, or personal information was shared, you can also go straight to where to report it.
Related situations: Someone wants me to move my money , Someone wants gift cards, crypto, or cash .
Sources
-
Regulator alert
What's a verification code and why would someone ask me for it?
-
Regulator guidance
Recognize and Report Phishing
-
Regulator alert
The Google Voice scam: How this verification code scam works and how to avoid it
-
Consumer assistance resource
Receiving one-time codes you did not request