Why You Should Never Share a Verification Code
One-time codes protect accounts because only the person with the phone should see them. Scammers know they can't guess a code, so they do the next best thing. They convince you to read it out. These scams are behind a large share of hijacked messaging, email and bank accounts.
The most common tricks
- "I sent my code to you by mistake." A message, often from a friend's already-hijacked account, asks you to forward a code you just received. That code is for your account, and forwarding it hands your account over.
- Fake support calls. Someone claiming to be from your bank, carrier or a delivery company says they need to "verify" you and asks for the code that's about to arrive.
- Fake login pages. A link leads to a convincing copy of a real site. You enter your password and code. The attacker uses them on the real site instantly.
- Prize and job scams. "To receive your prize or payment, confirm the code we sent."
The rules that stop them
- A code is only for typing into the app or site you're logging into yourself. Never read it to anyone, never forward it, never paste it into a chat.
- Real companies don't ask for your codes. Banks, carriers and platforms say this explicitly, often in the SMS itself.
- If you didn't request a code, someone else did. Ignore it, don't share it, and consider changing that account's password.
- Check the address bar before entering a password and code. Better still, use a password manager. It won't auto-fill on a fake domain.
- Call back on an official number if a caller claims to be from a company. Don't use the number they give you.
Stronger protection
Phishing-resistant sign-in methods, namely passkeys and hardware security keys, don't have a code to share, so these scams simply don't work against them. Turn them on for your email, banking and main social accounts where they're available. For messaging apps, enable the extra PIN or two-step verification setting they offer, so a stolen SMS code alone isn't enough.
If you already shared a code
- Try to log in and change your password immediately. Sign out other sessions.
- Turn on or reset two-step verification.
- Warn your contacts that messages from your account may be fake.
- Contact the service's official support and, for financial accounts, your bank.
telly.cat numbers receive codes for sign-ups you start. The same rule applies there. Codes shown on your dashboard are for you alone. Our team will never ask you for one.
FAQ
Why do scammers ask for verification codes?
The code lets them log into or take over your account, often your messaging or bank account.
What should I do if I shared a code?
Log in and change your password, sign out other sessions, turn on two-step verification and contact the service.