Is this OTP / verification code request a scam?
Commonly seen since 2023. Last reviewed 2026-06-05.
Check your exact messageExample only - do not act on it
Example only: I accidentally sent my code to your number, can you read it back to me? It's urgent.
Why this message is suspicious
- No legitimate person or company needs a code sent to your phone.
- Sharing the code hands over access to your account.
- It often comes with a friendly or urgent excuse.
What the scammer wants
- The one-time code to take over an account
- Access to WhatsApp, email, or banking
Common variations
- A 'friend' asks you to forward a code
- Support asks you to read a code
- You receive a code you did not request
Red flags to watch for
What to do now
- Never share a code with anyone.
- If a 'friend' asks, contact them another way to check.
- Enable two-step verification on your accounts.
What not to do
- Never read out or forward a code.
- Do not assume a message is really from a friend.
- Do not ignore a code you did not request - secure that account.
If you already responded
Act quickly - the sooner you respond, the more you can limit. Find the situation that matches what you did:
If you clicked a link: There is usually no link; if there was one and you entered details, change that account's password from a trusted device.
If you paid: Not typically money-based, but if you paid anything, contact your bank.
If you shared a code, OTP, or login: Act fast: change the account password, sign out of all sessions, and turn on two-step verification. For WhatsApp, see the account-hacked guide.
If you only clicked the link but entered nothing: close the page, don't enter anything, and watch the linked accounts for unusual activity. Full steps →
If you entered card details: contact your bank now to freeze the card and dispute charges, then watch your statement. Full steps →
If you shared an OTP or one-time code: the scammer may be logging in right now - change the password, sign out other sessions, and turn on app-based 2FA. Full steps →
If you sent money: contact your bank or payment provider immediately to try to stop or recall it, and report it. Full steps →
If you installed an app / gave remote access: disconnect from the internet, uninstall it, and change key passwords from a different, trusted device. Full steps →
If you shared passport, ID, or KYC documents: watch for identity theft, consider a credit freeze or fraud alert, and keep the evidence. Full steps →
Watch out for a second scam. People who've just lost money are often contacted again by a fake "recovery" service promising to get it back for an upfront fee. Legitimate recovery never starts with a fee paid to someone who contacted you - see recovery scams.
First time dealing with this? Start with the first 24 hours after a scam checklist and how to save evidence.
How to report it
Report through official channels for your country. Use our scam reporting directory to find the right authority, and never use phone numbers or links from the suspicious message itself. If an official link looks outdated, tell us so we can review it.
Official sources checked
-
Law-enforcement alert
Reviewed 2026-06-05. See our methodology for how we select sources.
Related pages
- Phishing
- Instagram account recovery scam
- What to do if you shared an OTP
- What to do if your WhatsApp was hacked
Related platforms
Frequently asked questions
Why would a friend ask for my code?
Their account may be hacked, and the scammer is using it to take over yours. Verify with them through another channel and never share codes.