You Got a Verification Code You Didn't Request. Here's What To Do.

Your phone lights up with a six-digit verification code from a company you recognize. Then another code arrives. Maybe a third one comes from a different service.

You did not try to sign in anywhere.

That is enough to make anyone uneasy, especially when the messages say things like, "Do not share this code." But an unexpected code does not automatically mean someone has taken over your account. It may mean someone tried to sign in, someone entered your phone number or email by mistake, or a code was delayed from an earlier request.

The right response is not panic. It is a short, careful account check.

What the code is protecting

A verification code is usually part of multi-factor authentication. A password is one proof that you are you. The temporary code is a second proof.

That is why the Federal Trade Commission gives a very simple warning: anyone who contacts you and asks for your verification code is a scammer. A legitimate employee should not need you to read that code aloud, text it back, or enter it on a page they sent you.

The code is the last locked door. Do not open it for someone else.

Why this trick works

The code itself may only be the beginning. A scammer may already have a password, or may simply be testing whether an account exists. The next step can be a call or message that appears to come from "security," "fraud prevention," or "customer support."

They may say:

• "We detected suspicious activity and need to verify your identity."
• "Read me the code we just sent so I can secure the account."
• "Act now or your account will be locked."

The message creates uncertainty. The follow-up creates urgency. Together, they can make a reasonable person cooperate before stopping to check who is really asking.

Warning signs to notice

Be especially cautious when:

• You did not request the code.
• Someone contacts you immediately afterward and asks for it.
• The person wants you to click a link instead of opening the official app.
• You are told to keep the conversation secret or stay on the phone.
• The caller threatens an account closure, arrest, lost refund, or other immediate consequence.
• You receive repeated sign-in prompts or approval requests you did not start.

An unexpected code by itself is not proof that your password was stolen. Repeated codes, unfamiliar devices, password-reset notices, or denied multi-factor prompts deserve a closer look.

The 60-second defense

Use this family rule:

A verification code is entered only by the person who requested it, inside the official app or website. It is never read aloud or sent to someone else.

Then take these steps:

1. Do not reply, share the code, or click a link in the message. You can ignore or delete an isolated code you did not request.
2. Open the company's official app or type its known website yourself. Do not use the link in the text or email.
3. Review recent sign-ins, devices, and security activity. Remove any device or session you do not recognize.
4. Change the password if you see suspicious activity or repeated attempts. Make it strong and unique. Do not reuse a password from another account.
5. Check your recovery phone number and email. Make sure they still belong to you. If available, consider an authenticator app or passkey.
6. For a work account, report repeated prompts to your IT or security team. For a bank or card account, call the number printed on the card or statement.

Do not approve a sign-in prompt just to make it stop. If you did not start the sign-in, deny it.

Talk about it tonight

Ask your family: "If someone called and asked for a six-digit code to protect your account, what would you do?"

The answer you want is simple: hang up, open the official app, and contact the company using a number or website you already trust.

One calm conversation now can make that decision much easier when a convincing caller creates pressure later.

Not sure about the follow-up message?

If a text, email, or caller follows the code with instructions, paste the message into the free Scam Detector. Remove names, account numbers, passwords, and the verification code before submitting it.

Scammers want you rushed and alone. Pause, verify, and talk to someone you trust.

Sources

• Federal Trade Commission: What's a verification code and why would someone ask me for it?
• Microsoft Support: Troubleshoot Microsoft verification code issues
• Google Account Help: When Google might send you a text
• CISA: Implementing Number Matching in MFA Applications