In this guide 10 sections
At a glance
The short version.
Watch for
- A caller or message asks you to read back a one-time login code
- An approval prompt arrives for a login or device you did not initiate
- Repeated notifications pressure you to approve one just to make them stop
Already acted?
Use the provider’s official recovery flow immediately and change the password from a trusted device.
See every recovery stepWhat is changing now
The current pattern.
Verification-code scams combine impersonation with a real security message. The code genuinely comes from the account provider, but it was triggered by the scammer’s login or recovery attempt. Variants use bank fraud stories, marketplace verification, support calls, repeated push notifications and phone-number registration services.
How it works
How the scam unfolds.
The attacker may already know a password from phishing, reuse or a data breach. They start a login and create an authentic code or approval prompt. At nearly the same time, an impersonator contacts the account holder and supplies a story explaining why the code must be shared.
Another variant starts an account-recovery or phone-number registration flow. The victim is told that reading back the code proves identity or confirms a listing, while the code actually authorises an account or service controlled by the attacker.
The security message may say not to share the code, identify the attempted device or describe the action being approved. Those details are more reliable than the caller’s interpretation. A code should be entered only into the service the user intentionally opened for their own login.
Warning signs
Reasons to stop and verify.
- A caller or message asks you to read back a one-time login code
- An approval prompt arrives for a login or device you did not initiate
- Repeated notifications pressure you to approve one just to make them stop
- A marketplace contact says a code will prove you are a real person
- The caller’s explanation conflicts with the action described in the security message
- A request to change recovery email, phone, passkey or trusted-device settings
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
Sarah (Book Club)1 (warning sign 1) · saved contact
Hi! Sorry to bother you. I accidentally sent my 6-digit code to your number2 (warning sign 2) — could you forward it? Please!
At the same moment, a text arrives on your phone
Text messageYour login code is 482 916. Do not share this code with anyone.3 (warning sign 3)
Quick, it expires in a minute!4 (warning sign 4)
- A familiar name is not proof
The request comes from a real contact’s account, which may already be controlled by someone else. Check with your friend by calling a number you already have.
- A code that is yours, not theirs
Codes are sent to the phone linked to the account being accessed. A code on your phone is for your account.
- The genuine warning
The real security message tells you not to share the code. Trust that instruction over the story in the chat.
- Pressure to act before thinking
A one-minute deadline is designed to rush you past the warning.
Nobody legitimately needs a code sent to your phone. If a contact asks for one, call them on a number you already know — their account may have been taken over.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
A fraud caller explains a real banking code
- 01The opening
A caller claims to be investigating a suspicious card payment. During the call, a genuine text from the bank arrives with a six-digit code, making the call appear connected to the real account.
- 02The escalation
The caller says the code cancels the transaction and warns that delay will make the customer responsible. The text itself says the code approves a new device and should not be shared.
- 03The decision point
The bank sent a real message because someone initiated a real account action. That does not make the caller genuine; it shows that the caller may be the person attempting the action.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Read the security message literally
Identify the action, account and device described. Do not replace the provider’s warning with the caller’s explanation of what the code supposedly does.
- 02
Reject actions you did not initiate
Do not share a code or approve a prompt unless you personally started that exact login on a service you opened independently.
- 03
Open the real account
Use the official app or a saved address to review sessions, security alerts, recovery details and recent activity.
- 04
Move to stronger authentication
Where available, prefer passkeys or phishing-resistant security keys. They reduce reliance on shareable codes, but account-recovery details still need protection.
Prevention
Make the next attempt harder.
- 01
Strengthen sign-in on key accounts
Start with email, banking and your mobile account. Use passkeys or an authenticator app where available, and keep recovery details up to date.
- 02
Add a PIN to messaging apps
Many messaging services offer two-step verification or a registration PIN. It stops someone registering your number on a new device with a single code.
- 03
Use a unique password everywhere
A password manager makes it practical to give every account a different password, so one breach does not unlock the rest.
- 04
Protect your phone number
Some mobile providers let you add a PIN or port-out protection so your number cannot easily be moved to a new SIM. Ask yours what it offers.
If you already acted
Protect access and contact the real provider.
- Use the provider’s official recovery flow immediately and change the password from a trusted device.
- Sign out unfamiliar sessions and remove unknown recovery methods, devices, forwarding rules and app access.
- Secure any email or phone account that can reset the affected service.
- Contact the bank or payment provider if the account could move money or stored payment details.
- Warn contacts if messages may have been sent from the compromised account.
Common questions
Short answers to real doubts.
What can someone do with a one-time code?
Depending on the service, a code can let someone sign in as you, reset your password, register your number on a new device or approve a payment. That is why providers tell you never to share it.
I keep getting login approval requests I didn’t make. What does that mean?
Someone may already have your password and is hoping you will approve a prompt by mistake — or just to make the notifications stop. Deny every request, change the password through the real service and review the account’s active sessions.
Are passkeys safer than codes?
Passkeys are designed to work only on the genuine website or app they were created for, and there is no code to read out, which makes them much harder to phish. You still need to protect the email address, phone number and devices used to recover the account.
Sources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.