Never Share Your Verification Code: How OTP Scams Work

Never share your verification code: that one sentence is the single most important defense against OTP (one-time password) scams. A six-digit code that arrives by SMS is the key to logging in to an account or approving a transaction. That is why scammers do not bother trying to crack your password; they try to talk you into reading the code out to them. In this article we explain how OTP scams work and how to protect yourself.

What is an OTP and why is it so valuable?

An OTP, or one-time password, is a short-lived code sent during a login or transaction to confirm that the account really belongs to you. It reaches you by SMS, email or an app notification.

The code is valuable because it is the second step: even someone who knows your password cannot get in without it. But if the code is told to someone else, that protection disappears. That is why no real organization, employee or friend will ask you to read out a code over the phone, in a message or any other channel.

The golden rule: a code arrives only for an action you started yourself, and it is entered only on the screen of the relevant app or site. It is never told to anyone, anywhere else.

How does an OTP scam work?

The scammer tries to log in to an account or start a transaction, and in that moment the service sends a code to your number. Then they try to convince you to tell them that code. To do that, they create a "reason" for you. Common patterns include:

• A fake bank or agency call: "There is suspicious activity on your account; read out the code that arrived on your phone to verify."
• A buyer on a second-hand listing: "I sent the payment; forward me the code you received to confirm."
• A message pretending to be someone you know: "I typed your number by mistake, could you send me the code you got?"
• A courier or delivery person: "Tell me the code for the delivery."
• Fake tech support: "Share the code so we can recover your account."
• A giveaway or prize: "We need to verify your identity for your gift."

They all arrive at the same point: the code stands in for your approval. By reading it out, you effectively authorize the scammer's action with your own hands.

Red flags: how to spot the scammer

1. Urgency and pressure: "Tell me now, or your account will be closed / your money will be gone."
2. A code you did not expect: If a code arrives without any action from you, someone may be trying to get into your account. Share it with nobody.
3. Anyone who asks you to read out a code: Whatever the reason, the party asking for a code is fake.
4. Seeming to know the organization's details: A scammer may know your name, your bank or your latest transaction; that does not prove they are genuine.
5. Not letting you hang up: Keeping you on the line, or telling you "don't consult anyone," is a serious warning.
6. Creating a sense of trust: A friendly or very professional tone is not proof of honesty.

Codes in messages usually carry a "Do not share this code with anyone" warning. Take it seriously.

What to do if you shared the code

Act quickly, without panic:

1. End the conversation immediately and stop talking to the other party.
2. From a safe device, change the password of the account concerned and sign out of all sessions.
3. Check your two-step verification settings and recovery details (email, phone) and remove devices you do not recognize.
4. If you shared a banking or payment code, call your bank right away and have your card or account put under protection.
5. If you reused the password elsewhere, change it there too.
6. Report the incident to the service, your bank and the relevant authorities, and keep message and call records.

Do not feel embarrassed: these methods are built to be very convincing and even careful users get caught. What matters is reporting fast.

Protective habits

• Fix the rule in your mind: "Code = told to no one." Talk about it with your family too.
• Do not trust calls you did not start. Even if the caller claims to be from an organization, hang up and call the official number yourself.
• Check which action the code is for. The message usually names the service; if you did not start something with it, do not enter the code.
• Use a stronger method than SMS. Authenticator apps and passkeys reduce the risk of reading out a code. For a comparison, see our article on two-step verification.
• Keep account notifications on. React immediately when a new-device login alert arrives.
• Hide message previews on the lock screen. A code visible on a locked screen is a risk if someone is nearby.

The other side: limiting where your codes can be reached

Another way to protect yourself from code scams is to limit the places that hold your number. When you hand your real number to every site, the chance that the site and its partners reach you by call and text goes up, and so does the chance of receiving scam messages. We covered this in why you should not share your phone number everywhere.

For trivial or temporary sign-ups, you can use a single-use virtual number instead of your real one. The code lands only in your own panel, and there is nobody you ever need to share it with. You can see the options on the pricing page. Virtual numbers are not permanent and some platforms may restrict them, so on your valuable accounts use your own number and strong verification methods.

When a code does not arrive, stay calm and do not ask anyone else for it; for possible causes, read why your SMS code is not coming.

Common mistakes

A few habits make scammers' work easier:

• Typing or reading out the code without thinking, saying "let me just sort this out quickly."
• Approving without reading which action the code is for.
• Calling the number given in the message or by the caller to "verify."
• Reporting late out of embarrassment; early reports often reduce the damage.
• Never telling family members about this at all.

When a request for a code arrives, pausing for a minute to ask "did I start this?" is enough to stop most attacks.

Frequently asked questions

Could my bank ask me to read out a code over the phone?

No. A real bank employee will not ask you for an OTP, password or card verification code. If such a request comes, hang up and call the bank's official number yourself.

A code arrived even though I did nothing. What should I do?

Do not share or enter the code with anyone. Someone may be trying to get into your account; change your password and review your two-step verification.

Can I share the code if someone I know asks for it?

No, because the person messaging you may have taken over your acquaintance's account and could use your code for another action. Reach that person through another channel, such as a voice call, to confirm, and still do not read out the code.

I read out a code by mistake but nothing happened to the account. Can I relax?

No; take precautions anyway. Change the password, sign out of sessions and watch for alerts. For more information, see our frequently asked questions page.