Got a verification code you didn't request? Is it a scam?

What's circulating

A text, a chat message or an email arrives with a verification code from an app, a messaging service, a social network or your bank, and you did nothing to ask for it. Then comes the request: a contact says the code reached your number by mistake and needs it back, a buyer wants the code to check that you are a genuine person, or a caller from your bank's "fraud department" reads out a suspicious charge and asks you to read back the code that just arrived.

This page checks one claim: that a code you did not request is harmless and can be passed on to whoever asks for it.

How the scam works

• The code is real. It arrives because someone typed your number or email into a login, sign-up or password-reset form. The FTC explains that the code is only for you to log into your account, and that anyone who asks you for your account verification code is a scammer.
• The FTC also explains why a scammer wants it: if you give them the code, they can log into your account and transfer the money out of your savings or investment accounts.
• The WhatsApp version: Bitdefender says an unsolicited WhatsApp verification code usually signals an attack attempt, and that attackers often pose as friends or contacts and trick you into sharing the code, claiming it was sent "by mistake".
• Once they have it, scammers can lock you out, impersonate you and target your contacts for further scams.
• The marketplace version: the FTC describes scammers who answer a listing, say they want to verify that you are a real person, then send you a text message with a Google Voice verification code and ask you for that code.
• If you give them that code, they will try to use it to create a Google Voice number linked to your phone number, which they can use to rip off other people and conceal their identity.
• The bank version: in one case a TV station reported, scammers made four transfers of one thousand dollars each from a customer's account using the six digit code he had read to a caller who claimed to be his bank.

The signs

• You did not try to log in, sign up or reset a password, and a code arrived anyway.
• A message or call follows, often within minutes, asking you to send the code back, read it out or forward it, with a story attached: a mistake, a check that you are a genuine person, a suspicious charge that must be stopped right away.
• The request comes from a friend's account, from a number you do not know, or from a caller whose number looks like your bank's.
• There is pressure to act before the code expires.

What to do

• Do not send the code to anyone: not to a contact who says it reached you by mistake, not to a buyer, not to a caller who says they are from your bank or from the company that sent it.
• If the code came from Google, Google's help page on its texts says you can disregard and delete a text code you did not request.
• The same page says not to share any codes you receive with anyone.
• The FTC says that if someone asks you for your verification code, don't engage: hang up, block their number and stop texting them.
• If you are worried about your account, the FTC says to contact your bank, credit union or investment advisor directly, using a number you trust, like the one on your statement or in your app, and never the number the caller gave you.
• A code you did not ask for means someone has your number or email and is trying to get in: change that account's password and turn on two-step verification where the app offers it.
• Got the request in writing? Paste the message into VOM, without the code, before you reply.

Where to report

• Report the person who asked for the code to the FTC at ReportFraud.ftc.gov: the FTC's alert on verification codes says to report them there.
• The FBI's IC3 takes reports of online fraud and scams: file a report even if you are unsure whether your complaint qualifies.
• Forward the text to SPAM (7726): the FTC's guide to phishing says that if you got a phishing text message, forward it to SPAM (7726).

Frequently asked questions

Got a code you never asked for? Was your account hacked?

Not necessarily, but someone is trying to get in: Bitdefender says an unsolicited WhatsApp verification code usually signals an attack attempt. Keep the code to yourself and turn on two-step verification in the app, which Bitdefender recommends as an extra layer of protection.

Someone says the code was sent to you by mistake. Should you send it back?

No. Bitdefender says attackers often pose as friends or contacts and trick you into sharing the code, claiming it was sent "by mistake". If the message came from a friend's account, reach that friend another way before you answer.