In short
“I sent you a code by mistake, can you send it back?” How scammers steal WhatsApp, email and bank accounts with one-time codes, and how to lock yours down.
Top warning signs: Anyone asking for a code, even a friend; A code arrives that you didn't request; Calls from “support” asking you to read a code to verify you.
First thing to do: Never share codes. Ignore and delete unexpected ones.
How the scam works
One-time codes confirm that you are the owner of an account. When a scammer tries to log in to your WhatsApp, email or bank, the service sends you a code. If you share it, they're in, and you may be locked out.
Taken-over accounts are then used to message your contacts with the same trick or with money requests.
Red flags to look for
- Anyone asking for a code, even a friend. Codes are for you only. No exceptions.
- A code arrives that you didn't request. Someone is trying to access your account.
- Calls from “support” asking you to read a code to verify you. Real support never asks for this.
What to do if you get one
- Never share codes. Ignore and delete unexpected ones.
- Turn on two-step verification: in WhatsApp, go to Settings → Account → Two-step verification and set a PIN.
- Use a password manager and unique passwords so one breach doesn't open everything.
If you already paid or shared details
Act quickly. It makes a difference.
- Try to log back in straight away. The service will send you a new code.
- Change your password and enable two-step verification. Warn your contacts that messages from you may be fake.
- If a bank code was shared, call your bank now.
More help: what to do after a scam, and where to report it in your country.
How to protect yourself next time
Turn on two-step verification, ideally with a security key
With two-step verification, a stolen password isn't enough on its own. A hardware security key goes further: it simply doesn't work on a fake site, so it can't be phished.
Free: Two-step verification is free. Switch it on in the security settings of your email, bank, WhatsApp and social media accounts today.
- YubiKey (Yubico) Partner link A small USB or NFC key you tap when you log in. It will not work on a fake site.
Use a password manager
It only fills in your password on the real website, so a look-alike login page gets nothing. It also makes a different password for every account, so one leak doesn't open the rest.
Free: Bitwarden has a free plan, and even the password manager built into your phone or browser beats reusing one password everywhere.
- NordPass Partner link Password manager with a free plan and a family plan for up to six people.
Compare the tools that help, and what each costs
Links marked Partner link may earn us a commission, at no cost to you. It never changes our advice, and the free option always comes first. Affiliate disclosure.
Questions people ask
My friend really did send it. Can I trust them?
Your friend's account may already be hacked. Call them to check. Either way, never forward a code.
Have you had this one?
Tell other people what the message said and how it reached you. It helps someone recognise it before they tap.
No stories yet. Yours could be the one that warns someone.
Official sources and further reading
We check our guides against advice from government agencies and consumer protection bodies.
- What's a verification code and why would someone ask me for it? (US Federal Trade Commission)
- Account or identity takeover scams (Scamwatch, Australian Competition and Consumer Commission)
