My old coworker Stan got a call on a Wednesday afternoon from a friendly young man who said he was with his bank's fraud department. "Mr. Kowalski, we've blocked a suspicious $900 charge at a store in Ohio. To confirm your identity, I'm sending you a verification code. Just read it back to me."
Stan's phone buzzed with a text from his real bank. Six digits. It looked completely official, because it was. So he read the code out loud. The young man thanked him and said everything was taken care of.
Well, folks, it wasn't. That code let the scammer reset Stan's online banking password. Within an hour, $2,300 had been sent out of his checking account. His bank recovered most of it, but Stan spent two weeks sorting it out.
Why would someone ask me for a verification code?
A verification code is a one-time key. Companies text it to you to prove that you are the person signing in, resetting a password, or approving a payment. When a scammer asks you to read it back, they're really asking you to hand over that key.
The FTC explains why scammers want your verification codes: with the code, they can get into your accounts. And here's the tricky part. The code itself is real. It came from your real bank. That's exactly why it feels so convincing.
What should I do if a caller asks for my code?
In plain words, three steps. First, don't share the code, not out loud and not typed into a reply. Second, say "I don't give codes to callers," and hang up. Third, call the number on the back of your card, or open your bank's app the way you normally do, and ask whether anything is wrong.
You don't owe the caller an explanation, and you don't need to argue. The polite young man will have a smooth answer for everything. Hanging up is the answer he can't argue with.
How do I know the text itself is warning me?
Read the whole message before you do anything. Many real verification texts say something like "Never share this code" or "We will never call you to ask for this code." If you didn't just try to sign in or reset a password yourself, a code showing up is a red flag that someone else is trying to get into your account.
Put simply, it's a scam if someone called or texted you first and then a code showed up, if you didn't try to sign in yourself, if the message says "never share this code," or if the caller says they need it to protect or verify you. A real code plus a stranger asking for it adds up to a scam every time.
What if I already gave someone my code?
Act fast, and don't be embarrassed. Call the company that sent the code right away, using the number on your card or its official website, and tell them exactly what happened. Ask them to lock the account and reverse any changes. Then change your password from your own phone or computer, and check for any new email address or phone number the scammer may have added.
If money left your account, ask your bank about recovering it and report the scam at ReportFraud.ftc.gov. A free credit freeze is also a smart extra step if the scammer had your personal details.
How can I make this rule easy to remember?
Write one sentence on a sticky note by the phone: "I don't give codes to callers. I'll call the company myself." Say it out loud a couple of times so it comes naturally. And if your bank or email offers a passkey, consider setting one up. Passkeys are much harder for scammers to steal this way.
This trick often comes packaged with the fake bank call. Our guide on what to do when your "bank" calls covers that side of it.
What Stan does now
Stan has a sticky note on his refrigerator, right next to the grandkids' pictures. It says "CODES ARE MINE" in big block letters. Last month a caller claiming to be from his phone company asked for a code. Stan said, "Nope, codes are mine," hung up, and called his carrier. There was nothing wrong with his account.
That code is a key to your house, folks. You wouldn't hand your house key to a stranger on the phone.
Has anyone ever asked you for a verification code? Tell us in the comments what they claimed.
