Your phone buzzes. Six digits, no context. Someone on the line says they need those digits to protect you. They do not. They need them to get in.
What a verification code is
A verification code, also called a one-time code, is a short number sent to your phone, email, or an app. It confirms that you are the one signing in or taking an action right now. The Federal Trade Commission explains the basic idea: the code proves identity at one moment, so it is useful only to the person who asked for it.
Many accounts pair a password with a second factor. The Better Business Bureau sorts these into three groups. Something you know, like a PIN. Something you have, like a phone that gets a text. Something you are, like a fingerprint. The common code is six digits, sent by text or email, and sometimes read out in a phone call.
The design is simple. A stolen password alone should not open the door. But the second lock only works if the code stays with you.
How scammers use codes
A scammer usually needs two things. The password, then the code. The password often comes first, from a data leak, a fake sign-in page, or a reused credential. The code is the missing piece, and you are the only one who can hand it over.
So they call. They pose as a bank, a utility, or tech support. They say the code will verify you, stop fraud, or cancel a charge. This is social engineering: impersonation, a calm voice, and a little urgency. No lock gets picked. You open it yourself.
Some schemes are sideways. The Better Business Bureau reported a case where fake buyers on an online marketplace asked a seller for a phone number and a six-digit code, saying it would prove the seller was real. Those details may then be used to set up phone-based accounts for other schemes or identity fraud. Nobody was hacked. The seller was just helpful.
Codes can also arrive by mistake. Login.gov notes that someone may have typed your number while creating their own account. Or someone with access to your phone may be signing in to theirs. Either way, a code you did not request is a signal to pay attention.
Why you should never share them
The code is worth something only because it says you are there. Read it aloud, forward it, or type it into a page someone sent you, and you have handed over that presence. A company with a real reason to contact you has no reason to ask you to repeat a code back.
Big companies say this plainly. Apple states that it never asks for your verification codes or account password to provide support, and tells customers not to share them with anyone. Treat any request for a code as a red flag, however official the voice sounds.
Think of it as the last lock on the door. Give it away and the scammer may sign in, change your recovery details, and lock you out. The rule is dull and reliable. The code is yours alone.
Red flags, in order of how fast to act
- Someone asks you to read back, forward, or enter a code you received.
- A caller claims to be your bank, utility, or a support team and wants a password or security code.
- Codes show up that you never requested.
- A prize message comes from a stranger, or says it is tied to a charity you support.
- A page you reached through a sent link asks for sign-in details or codes.
Any one of these is enough to stop. You do not need to see all five.
What to do first
Stop. Do not read, forward, or type anything. Hang up or close the message.
Then verify on your own terms. Skip the number, email, or link the message gave you. Use a phone number or website you already trust, such as the one on your card or statement. Check that a web address looks official and uses a secure connection before entering anything. The Cybersecurity and Infrastructure Security Agency says more than 90% of successful cyber-attacks start with a phishing email, so a fake link is worth the suspicion.
If codes keep arriving unrequested, do not reply or call any number in the message. Consider changing the password on the account involved, and look for accounts tied to your phone number that you do not recognize. If you already shared a code, contact the company that issued it through a verified channel and ask how to secure the account. The sources here do not spell out recovery steps for every service, so the company itself is the right place to ask. You can also document what happened by filing a report on the FTC's consumer website.
A six-digit code looks small. That is the appeal. Keep it to yourself.
