“I sent you a code by mistake — can you read it back to me?” It sounds harmless, even helpful. But that six-digit code is the key to one of your accounts, and the person asking is a scammer trying to walk straight through your front door. Our GetMyPassword team explains how to recognize a verification code scam and never hand your code away.
How the scam works
A verification code is the one-time number a service texts you to confirm it is really you. In this scam, the attacker triggers a real code to your phone — by trying to log into your account, reset your password, or sign you up for something — and then contacts you pretending to be the service, a buyer or a friend. They ask you to “confirm” or “read back” the code. The moment you do, they use it to get into your account or complete their fraud.
Where you will meet it
- A “buyer” on a marketplace who wants to “verify you are real” by a code they had sent to you.
- A “friend” locked out asking you to receive their code and pass it on.
- A “support agent” calling about suspicious activity who needs the code to “verify your identity.”
- An unexpected code arrives on its own, followed by someone urging you to share it.
The one rule that defeats it
A verification code is for you and only you. No legitimate company, support agent, buyer or friend ever needs you to read a code that was sent to your phone — the text itself usually says as much, with a line like “do not share this code.” So the rule is simple and absolute: never tell anyone a code you received, no matter how convincing or urgent the reason. If someone asks, that alone tells you it is a scam.
The code is the second key to your account. Anyone who asks you to read it aloud is asking you to unlock the door for them — so the answer is always no.
What to do instead
Ignore any request to share a code, and never read one back. Treat an unexpected code as a warning sign that someone is trying to get into your account: change that password right away from our password generator and make sure two-factor authentication is on. The codes are doing their job by blocking the attacker — keep them to yourself and the attempt fails. Pair them with a unique password per account, and one stolen password still cannot open the door.
Frequently asked questions
What is a verification code scam?
It is when a scammer triggers a real one-time code to your phone, then poses as a service, buyer or friend and asks you to read it back. With that code they get into your account or complete their fraud.
Should I ever share a verification code?
No, never. A code sent to your phone is for you alone, and the message itself usually warns not to share it. No legitimate company, agent, buyer or friend needs you to read it back — anyone who asks is running a scam.
I got a code I did not request — what should I do?
Treat it as a sign someone is trying to access your account. Do not share it. Change that account’s password right away and confirm two-factor authentication is on, so the attempt fails even if your password was exposed.