OTP Scams: Why You Must Never Share Your 6-Digit Code

Short answer: No legitimate company, bank, delivery driver, marketplace buyer or support agent will ever ask you to read out a verification code. Not one, ever, under any circumstance. If someone asks for your OTP, they are trying to take over an account — usually yours, sometimes one they are opening in your name. The correct response is to say no and end the conversation.

Why the code is the whole prize

A one-time password is the second factor standing between an attacker and your account. They already have your password, or your phone number, or enough of your details to trigger a login. What they lack is the code your phone just received.

So they ask you for it. It is cheaper than hacking anything, it works on people of every age and education level, and it takes under a minute. Persuading you to read out six digits defeats security that would otherwise cost enormous effort to break.

The message accompanying the code almost always says so explicitly — “never share this code” — and the scam works anyway, because the attacker gives you a reason to make an exception.

The seven scripts you will actually encounter

1. The marketplace “verification” scam

You list an item for sale. A “buyer” says they want to check you are a real seller and will send a code. What they are actually doing is creating an account — often a Google Voice or messaging account — using your phone number, and the code you forward completes their registration. You gain nothing; they gain a phone-verified account to run scams from, tied to your number.

Rule: no genuine buyer needs to verify you with a code. Ever.

2. The messaging account takeover

A message from a friend’s account: “I accidentally sent my verification code to your number, can you send it back?” The friend is already compromised, and the code is for your messaging account. Forward it and you lose the account, and the same message goes to everyone you know.

This is why a separate PIN matters — see WhatsApp two-step verification, which blocks the takeover even if the SMS code is stolen.

3. The fake bank fraud department

A call from a spoofed number: “We have detected a suspicious transaction. To cancel it, read us the code we have just sent.” The code is authorising the transaction, or a new payee, or a password reset. Caller ID is trivially faked, so the number matching your bank’s proves nothing.

Rule: hang up and call back on the number printed on your card. Never continue a call someone else started about your money.

4. The delivery driver at the door

Increasingly common. A courier asks for the OTP sent to your phone to “confirm delivery” — but the code is for a high-value order being redirected, or a mobile wallet transaction. Legitimate delivery confirmation codes are shown to you to give to the driver, not requested from your incoming messages. Read the SMS itself: it will tell you what the code authorises.

5. The support agent who called you

“I am from the security team, we noticed unusual activity, I need to verify you.” Real support agents verify you through the app or website you initiate contact from, and never need a code you receive. A support person who called you and wants a code is not support.

6. The prompt storm

Not a request for a code but for a tap. Push approval prompts arrive over and over until you approve one to stop the noise, or approve by reflex. Covered in detail in push notification 2FA and prompt bombing. An unrequested prompt means your password is already compromised — deny it and change the password.

7. The real-time phishing page

The most technically sophisticated version, and the one where nobody asks you for anything. You click a link, land on a perfect copy of a login page, and type your password and code as normal. Both are relayed to the real site within the window. This is why “I would never share my code” is not, by itself, sufficient protection — see can 2FA be hacked?

The rules that cover all of them

1. Never read out, forward, type into a chat, or screenshot a verification code. No exceptions. There is no legitimate scenario.
2. Read the message before acting. The SMS says what the code does — “code to add a new payee”, “code to reset your password”. If it does not match what you are doing, something is wrong.
3. A code you did not request is an alarm. It means someone has your password or your phone number and is trying to get in. Change the password immediately.
4. Never continue an inbound conversation about your accounts. Hang up, close the chat, and reach the company through a number or app you found yourself.
5. Never type a code on a page you reached by clicking a link. Navigate to the site directly. This single habit defeats phishing.
6. Urgency is the tell. Every one of these scripts needs you to act before you think. Genuine organisations can wait five minutes.

How to make yourself harder to scam

Beyond vigilance, some changes remove the attack entirely:

• Move off SMS codes where an authenticator app is available. Codes generated offline on your device cannot be requested by a scammer who triggered a login — see SMS 2FA vs authenticator apps.
• Use passkeys or a security key on your most important accounts. There is no code to hand over at all, and the credential refuses to work on a fake domain — see phishing-resistant MFA.
• Add a carrier port-out PIN so your number cannot be moved to another SIM — see SIM swap attacks.
• Set app-level PINs where offered, such as WhatsApp and Telegram, so a stolen SMS code alone is not enough.
• Tell your family the rule. Older relatives and teenagers are targeted disproportionately, and one sentence — “nobody legitimate ever asks for the code” — is genuinely protective.

If you have already shared a code

Act in this order, fast:

1. Change the password on the affected account, from a device you trust.
2. Sign out all sessions — most services have a “where you’re logged in” page. A password change alone may not evict an existing session.
3. Check recovery details — email address, phone number, security questions. Attackers change these first to lock you out.
4. Check for forwarding rules and filters if it was an email account. A hidden rule quietly forwarding your mail is a standard follow-up move.
5. Re-enrol 2FA from scratch, and remove any devices or methods you do not recognise.
6. Warn your contacts if it was a messaging or social account — the next stage of the scam runs through them.
7. Contact your bank immediately if money is involved, and report it to your national fraud reporting service.

Our guide on regaining access to accounts covers the recovery paths in more depth.

Frequently asked questions

Can someone hack my account with just the code?

Usually they need the password too — but not always. Many services now offer passwordless sign-in by code alone, and account recovery flows often accept a code plus basic personal details. Treat the code as the key it is.

Is it safe to share a code with a family member?

Only if you asked them to help you log into your own account and you initiated it. Even then, prefer sitting together. The scam script always includes a reason it is fine.

What if the caller knows my name, address and last transaction?

That data is widely available from breaches and is bought in bulk precisely to make these calls convincing. Knowing your details proves nothing. Hang up and call back on a number you looked up yourself.

Why do I keep receiving codes I didn’t request?

Someone is attempting to log in as you, and probably has your password. Change it, check for reuse elsewhere, and consider moving to an authenticator app or passkey. Do not ignore it because “the code didn’t work for them”.

Are authenticator app codes safe from this?

Safer, because a scammer cannot trigger the code arriving on your phone — no message shows up to be forwarded. But you can still be talked into reading a code out of the app, or typing it into a fake site. Our guide to how TOTP codes work explains the difference.

Should I reply to tell the scammer no?

No. Do not engage at all. Block, report, and delete. Replying confirms your number is active and moves you up their list.

The bottom line

One rule, no exceptions: the code is never shared, never forwarded, never read aloud. Every story that makes it seem reasonable is the scam. And a code arriving that you did not ask for is not a nuisance — it is an alarm telling you someone already has your password.

Want the code that cannot be stolen this way? Read passkeys vs 2FA, or generate and test codes safely with our browser-based 2FA code generator.