Never Share Codes
The caller says they are from your bank, or support, or the delivery company — and they just need the code that was texted to you. That code is the key to your account: anyone who has it can log in as you, reset your password, or approve a payment. No legitimate company ever asks for it. This guide explains the trick, the exact words to end the call, and what to do if you already shared a code. Set up a family safe word too, since these scams increasingly target relatives with cloned voices.
TL;DR / Quick Fix
Quick fix: never read a verification code to anyone who calls or texts you — real companies never ask. If you already shared one, change that account's password immediately and check for unfamiliar activity. Tell family the same rule: a code texted to your phone belongs to you alone, always.
Follow these steps
- Understand what the code unlocks. That six-digit text is a login key. With it, a scammer can sign in as you, reset your password, or confirm a payment. Whoever holds the code controls the account — that is why they want it so badly.
- End the call with a simple line. Say 'I never share codes — I will call the company directly,' and hang up. Do not argue, do not explain, do not let them keep you talking — urgency is their weapon.
- Call the company yourself. Look up the real number — on your card, the official app, or the company website you type yourself — and call back. If there is a real issue, they will tell you without ever asking for the code.
- Act fast if you already shared one. Change the password on that account immediately, review recent activity and connected devices, and revoke unfamiliar sessions. Then turn on an authenticator app instead of texted codes where offered.
- Report the attempt. Forward the text to 7726 (SPAM) in the US, and report the call to the company being impersonated. Reports feed the filters that protect everyone else.
- Teach the rule to family. Make it a household law: codes are never shared, with anyone, for any reason. Kids and grandparents get targeted most — rehearse the hang-up line with them.
What NOT to do
- Do not read the code 'to verify it is really them.' There is no verification that requires you to share it — that sentence is the scam.
- Do not call back the number they give you. Scammers staff their own callback lines; use the number from your card or the official app.
- Do not assume a texted code is safe because it came to your phone. The code arriving is normal — the request to share it is the attack.
- Do not wait to act if you shared a code. Minutes matter: password first, then review activity, then report.
Frequently asked questions
But what if it really is my bank?
Then they will handle it when you call the number on your card. Real banks train staff never to ask for codes — the request itself proves it is not them.
Can scammers use an old code?
Codes expire in minutes, which is why scammers create urgency. An expired code is useless — but the account may still be at risk if they got anything else from you.
Are authenticator apps safer than texted codes?
Yes. App codes cannot be talked out of you over the phone the same way, and they are not vulnerable to SIM swapping. Switch where you can.