Do not give an unexpected verification code to another person
A one-time code may approve a login, password reset, number transfer, payment, device enrollment, or account change. A person who asks you to read or forward that code may be trying to complete an action against your account, even if the caller ID, message thread, or explanation appears familiar.
Read the code message for the action it names
Do not click its link or call a number inside an unexpected message. Note the service and action described, then open the official account independently. If you did not start the action, deny or abandon it where the service offers that control and review recent activity.
A code can reveal which account is under pressure
An unexpected code for email deserves high priority because email can reset other accounts. A carrier code may relate to a SIM, device, or account change. A financial code may authorize access or a transaction. Use the service's real support route when the account shows a change you cannot reverse safely.
Check more than the password
- Unfamiliar sessions, devices, or login locations.
- Changed recovery email, phone, or trusted devices.
- New forwarding rules, app passwords, connected apps, or payees.
- Messages, purchases, transfers, or profile changes you did not make.
If access changed, follow the account takeover response checklist. Use the MFA and recovery guide to remove weak fallback methods after the account is stable.
Preserve useful evidence without spreading the code
Record the sender, time, service named, caller or message account, and action requested. Do not post an active code or full account details publicly. Report the impersonation through the real service or appropriate fraud channel. If you already shared the code, say that clearly when contacting the provider so the response addresses a potentially completed action rather than only an unwanted message.