When a caller asks for a verification code

Your phone rings. The caller says there's a problem with your account and offers to help. Then a text arrives with a short code, and the caller asks you to read it aloud.

If a caller asks for a verification code during an unexpected call, stop before sharing it. The code may let someone sign in to your account. You can end the call and check with the organization yourself, using contact information you already trust.

What is a one-time sign-in code?

A one-time sign-in code is a short code an account sends or gives you to help confirm that it's really you signing in. You might receive it in a text or email, or find it in an authentication app you set up for the account. It is usually meant to be used once and may expire after a short time.

For example, after you enter your password on your bank's genuine website, the bank may send a code to your phone. You enter that code on the sign-in screen you opened yourself. The extra step is often called two-factor authentication. It adds a layer of protection alongside your password.

The Federal Trade Commission explains how verification codes work and warns against giving an account verification code to someone else. Keep using the extra sign-in step; the concern is sharing the code with a caller, not receiving a code when you're signing in.

Why would a caller want it?

Someone pretending to be from a bank, a technology company, or another organization may claim they need the code to check your identity or fix an account problem. The story can sound helpful. The caller may already know your name or other details, but that doesn't establish who they are.

The caller may be trying to sign in to your account on another device. If the service sends a code to you, reading it to the caller could give them the missing piece they need. A code arriving during the call doesn't prove the caller is genuine; it may be connected to an attempt you didn't start.

Not every unexpected code means someone has entered your account. Someone could have made a mistake. Either way, don't pass the code along or approve a sign-in you didn't start. Check the account independently if you're concerned.

What to do during an unexpected call

You don't need to decide whether the caller's story is true while you're on the phone. Take these steps instead:

1. Keep the code private. Don't read it aloud, forward the message, or type it into a link the caller sends. Don't approve an unexpected sign-in request, either.
2. End the call. You can hang up even if the caller says the matter is urgent. You don't have to stay on the line to explain.
3. Find your own contact details. For a bank or card company, use the number on the back of your card or a statement you already have. For another account, use its app or a website you open yourself and know is genuine. Don't use a number supplied by the caller or rely on caller ID.
4. Ask about the account. Call the trusted number yourself and explain that an unexpected caller asked for a sign-in code. Ask whether there is an issue and what, if anything, you should do next. Keep your code private.

If you can't find a trusted number right away, it's okay to pause while you look. A family member or friend can help you find the right contact information without needing your password or code. Our guide to spotting phone scams targeting seniors covers other ways to check an unexpected call.

If you already shared a code

Stop the conversation and contact the affected organization promptly using a trusted number or its genuine app or website. Tell them that you shared a one-time sign-in code and ask them to help secure the account. If it's a bank or card account, ask them to check for activity you don't recognize and follow their instructions.

If you can still sign in safely, change the account password. If you used that password elsewhere, change it on those accounts too. Review the account's recent activity and its recovery phone number and email address for changes you don't recognize. Ask the provider how to sign out other devices or sessions and restore any settings that were changed. If you can't sign in, use the provider's official account recovery process.

If the affected account is your email, tell the provider: email can be used to reset passwords for other accounts. Check those accounts as well, starting with financial accounts and any that share the same password. Keep two-factor authentication enabled, and ask the provider for help choosing or restoring a sign-in method you can use.

Sharing a code can happen to anyone. You can take the next step without blaming yourself, and a trusted person can sit with you while you contact the provider.

Make the safe path easier to find

Keep a trusted statement or card where you can find it, and save the genuine account app or website in a place that's easy to recognize. You don't need to write down a verification code: a new one can be provided when the account asks you to sign in. Never save passwords or codes on a note beside your phone.

If you'd like help finding messages or opening an app on your phone, our smartphone basics guide walks through the essentials. The important choice remains yours: end an unexpected call, keep the code private, and check the account using a route you found yourself.