A verification code is a short one-time number that a service sends by text, email, or authenticator app to confirm that you are the person completing a sign-in, password reset, or other sensitive step. Someone who asks you for it usually wants to finish that step as you, and that request is the core of a verification code scam, also called an OTP scam or verification code phishing.

The code is not a customer-service reference number. It is often the final proof that a system uses to authorize a sensitive step. In a normal flow, you request the action and enter the code yourself on the official screen. In a scam, another person starts a login, reset, phone-number registration, payment, or account link and asks you to read, forward, or screenshot the code. The FTC's rule is direct: account verification codes are for you to use, and someone asking you to provide one is a scammer.［1］

Key Takeaways

Never tell a caller, buyer, seller, recruiter, support agent, or chat contact a verification code.

A code arriving without an action you started is a warning that someone may be testing your account or number.

Read the whole message; many providers state what the code authorizes and warn not to share it.

If you shared a code, identify the service that sent it and secure that specific account or registration immediately.

What are verification codes used for?

Services use one-time codes for different purposes: completing a sign-in, confirming a password reset, approving a transaction, verifying ownership of a phone number, registering an authenticator, linking an external account, or recovering access. The delivery channel is only one part of the meaning. The message text, sender, service, timing, and action being performed determine what the code can authorize.

Two-factor authentication commonly combines a password with a temporary code. The password is one proof and the code is another. If a criminal already has the password, persuading the victim to share the second factor may complete the login. The FTC explains this as two separate locks and warns that scammers seek the code because they need the remaining key to enter.

Not every code proves identity for an existing account. A phone-number verification code may let someone attach your number to a new service. A bank code may approve a login, new payee, transfer, card addition, or device registration depending on the institution. Never assume a small or harmless-looking request has a small consequence.

Code context	Normal behavior	Scam behavior
Sign-in or password reset	You started it and type the code into the official app/site	Caller says they need the code to “secure” the account
Marketplace identity check	Platform verifies within its own interface	Buyer asks you to forward a code sent to your phone
Bank alert	You call the trusted number and authenticate through approved steps	Incoming caller asks for a code to stop fraud or reverse a payment
Phone-number registration	You knowingly link your number to your own account	Stranger claims the code proves you are a real seller or person
Account linking	You initiated a connection and can see both services	Contact sends a link, triggers a code, then asks you to read it

Someone asked for my verification code: what stories do scammers use?

Impersonation makes the request feel reasonable. A fake bank investigator may claim that sharing the code cancels a fraudulent transfer. A marketplace buyer may say the code proves your listing is genuine. A supposed support agent may say it verifies your identity, removes malware, stops a login, or closes a case. A criminal pretending to be a friend may say a code went to the wrong phone.

The caller may know your name, bank, carrier, email, or account digits from a breach or public profile. That knowledge does not prove they represent the organization.

Some scammers trigger the code while speaking to you. The arrival can seem to validate the caller, but the real service is only responding to the request they just submitted.

How does the Google Voice verification code scam work?

In a common marketplace version, a scammer contacts someone who posted an item, lost pet, or service. The scammer says they need to verify that the poster is real. They start a Google Voice registration using the victim's phone number, causing Google to send a verification code. If the victim shares it, the scammer may use the number to complete the registration and obtain a Voice number for further scams.

The FTC explains that the fraud uses the victim's code to link a Google Voice number to the victim's phone; it also points affected users to Google's process for reclaiming the number.［2］ The immediate harm may be misuse of the phone-number link rather than entry into the victim's email, but the event should still prompt an account review. If the same password, email, or number is involved elsewhere, check those services independently.

Do not “verify yourself” for a stranger with a code. A legitimate marketplace can design verification inside its own app. A buyer or seller does not need a code sent to your personal account to decide whether to meet or complete a platform transaction.

How do bank impersonation code scams work?

A caller may spoof the bank's displayed number, mention a suspicious payment, and offer to protect the account. While keeping the victim on the phone, the criminal starts a login, password reset, transfer, digital-wallet enrollment, or other action. They then ask for the code, sometimes describing it as a cancellation or case code.

The safe response is to hang up and contact the bank through the number printed on the card, statement, or official app. The FTC warns that fraud calls can instruct victims to move money or reveal information and advises contacting the bank using a number known to be genuine.［3］ Caller ID, a familiar hold message, or accurate personal data does not replace that independent call.

If a transfer is already pending, contact the bank immediately. Do not wait to see whether the caller calls again. Preserve the code message and transaction details, but never send the code to a supposed investigator. A real employee's exact authentication procedure varies, yet an incoming caller should not need you to read a one-time code that authorizes the action they claim to be stopping.

What should you do before sharing a verification code?

Stop the conversation. Read the entire code message without clicking its links. Identify the named service and the action described. Ask yourself: Did I personally start this exact login, reset, registration, payment, or link? Am I entering the code into the official interface I opened, or giving it to another person?

If you did not start the action, do not enter or share the code. End the call or chat. Open the service from a bookmark or known app and review security activity. Contact the organization using details you already trust. Block and report the scam account on the platform where it contacted you.

Exposure level	What happened	Response
Code arrived, not shared	Someone may have started an action	Do not engage; inspect the named account and change any password that may be known, exposed, or reused
Code entered only in your own intended official flow	Likely normal use	Confirm the resulting action matches your intent
Code read, forwarded, or screenshotted to another person	Sensitive authorization may be complete	Secure the named service immediately and revoke unfamiliar sessions/actions
Code plus password, payment, or remote access shared	Multiple compromise paths	Contain accounts and payments; use a clean device; escalate to bank/security support

What should you do after sharing a verification code?

Start with the sender of the code. The message usually identifies the service and sometimes the action. Go directly to that service and check recent sign-ins, password resets, phone-number links, devices, transactions, recovery information, and security methods. Change the password if the attacker may know it, and sign out unfamiliar sessions. Remove new recovery details, passkeys, authenticator registrations, or connected apps that you did not add.

If the code was for a bank or payment service, call the trusted fraud number immediately and explain exactly which code you shared and what the message said. Ask the institution to inspect logins, device enrollment, beneficiaries, transfers, and card-wallet changes. If the code involved a Google Voice registration, use the official reclaim process. If it involved email, check forwarding rules and sent mail because email can reset many other accounts.

Follow the account-recovery sequence in Someone Logged Into My Account if unfamiliar activity appears. Preserve screenshots of the conversation, the original message, sender details, time, and transactions. Report the impersonation to the platform and appropriate fraud authority. Do not pay a stranger who promises to recover the account; that can become another online scam.

How is this different from SIM swapping, MFA fatigue, and smishing?

A verification code scam centers on social engineering: the criminal asks the victim to disclose a code. In SIM swapping, the attacker tries to move the victim's phone service or messages to a SIM or eSIM they control, so the attacker may receive codes without asking the victim. Both can affect SMS-based authentication, but the mechanism and response evidence differ.

MFA fatigue uses repeated approval prompts and pressure to obtain a tap rather than a spoken code. Smishing identifies SMS as the delivery channel for a deceptive message. A code scam can begin through SMS, phone, email, or marketplace chat, and the code itself may arrive through a legitimate channel. Labels can overlap, but responders should record exactly what was requested, delivered, shared, and approved.

The general defense is to keep authorization inside the flow you initiated. Use stronger authentication such as passkeys where available, protect email and phone-carrier accounts, and review recovery paths. The online security guide places those measures alongside unique passwords, updates, and incident preparation.

Frequently asked questions

Will a real bank ever send me a verification code?

Yes, banks use codes for legitimate actions. The warning sign is an incoming caller asking you to read a code for an action you did not initiate. End the call and contact the bank independently.

Is it safe to share a code with customer support?

Do not share a one-time code with someone who contacted you. If you initiated support, follow only the provider's official procedure and read what the code message says it authorizes.

What if the code says “do not share”?

Follow that warning. No explanation from a caller overrides the security message. Stop the interaction and inspect the account directly.

Can a scammer use an expired code?

An expired code should no longer authorize its intended action, but the scammer may request a new one or already have changed something. Review the named account and stop contact.

Why am I getting verification codes I didn't request?

Someone may have entered your number or email in a sign-in, password reset, or registration form, sometimes by mistake. It does not always mean your password is compromised, but a login attempt is possible: do not share the code, review activity, and change reused or exposed passwords.

What if I shared a code but nothing changed?

Act anyway. Revoke unfamiliar sessions, inspect recovery and security settings, and contact the provider. Some misuse is quiet or appears later.

Can I send a screenshot if I hide part of the code?

No. Screenshots can expose the full code, sender, account clues, or QR and recovery data. A stranger has no legitimate need for that evidence.

Where should I report a verification code scam?

Report the account or caller to the contact platform, the impersonated service, and the appropriate fraud authority. Contact the bank separately for any financial action.

This article provides general safety information, not a determination of compromise or financial advice. Use the affected provider's current recovery steps and seek professional incident support for sensitive or high-value accounts.

Sources

FTC — What's a verification code and why would someone ask me for it? — https://consumer.ftc.gov/consumer-alerts/2024/03/whats-verification-code-why-would-someone-ask-me-it
FTC — The Google Voice scam: How this verification code scam works and how to avoid it — https://consumer.ftc.gov/consumer-alerts/2021/10/google-voice-scam-how-verification-code-scam-works-how-avoid-it
FTC — Got a call about fraud activity on your bank account? It could be a scammer — https://consumer.ftc.gov/consumer-alerts/2024/06/got-call-about-fraud-activity-your-bank-account-it-could-be-scammer

Sources checked 4 October 2026.

What Is a Verification Code Scam?