In short
“I sent you a code by mistake, can you send it back?” How scammers steal WhatsApp, email and bank accounts with one-time codes, and how to lock yours down.
Top warning signs: Anyone asking for a code, even a friend; A code arrives that you didn't request; Calls from “support” asking you to read a code to verify you.
First thing to do: Never share codes. Ignore and delete unexpected ones.
How the scam works
One-time codes confirm that you are the owner of an account. When a scammer tries to log in to your WhatsApp, email or bank, the service sends you a code. If you share it, they're in, and you may be locked out.
Taken-over accounts are then used to message your contacts with the same trick or with money requests.
Red flags to look for
- Anyone asking for a code, even a friend. Codes are for you only. No exceptions.
- A code arrives that you didn't request. Someone is trying to access your account.
- Calls from “support” asking you to read a code to verify you. Real support never asks for this.
What to do if you get one
- Never share codes. Ignore and delete unexpected ones.
- Turn on two-step verification: in WhatsApp, go to Settings → Account → Two-step verification and set a PIN.
- Use a password manager and unique passwords so one breach doesn't open everything.
If you already paid or shared details
Act quickly. It makes a difference.
- Try to log back in straight away. The service will send you a new code.
- Change your password and enable two-step verification. Warn your contacts that messages from you may be fake.
- If a bank code was shared, call your bank now.
More help: what to do after a scam, and where to report it in your country.
Questions people ask
My friend really did send it. Can I trust them?
Your friend's account may already be hacked. Call them to check. Either way, never forward a code.
Official sources and further reading
We check our guides against advice from government agencies and consumer protection bodies.
- What's a verification code and why would someone ask me for it? (US Federal Trade Commission)
- Account or identity takeover scams (Scamwatch, Australian Competition and Consumer Commission)