Scam library
Verification code theft
Someone asks for a sign-in or recovery code and uses it to take over your account.
What it looks like
Fictional example: I accidentally sent my six-digit code to your phone. Can you send it back to me?
Fictional example: To confirm you belong in our group, reply with the account verification code you just received.
How it works
A scammer starts a sign-in, registration, or password reset using your details. They then persuade you to hand over the code that proves control of your account, sometimes from a friend's stolen account. With access, they can impersonate you and approach your contacts.
Warning signs
- A code arrives when you did not try to sign in.
- A friend says their code was accidentally sent to you.
- The request conflicts with the warning in the code message.
- Someone asks you to forward a recovery link or screenshot.
If you got one of these
- Keep sign-in, reset, and registration codes private.
- Contact the person through another established channel.
- If you shared a code, use the service's official recovery process immediately.
- Review linked devices and enable additional account protection.
If you already paid or shared something
- Contact your bank or payment provider about any money sent or taken.
- Recover the affected account, remove unfamiliar sessions, and secure its recovery email.
- Warn contacts through another channel and report the impersonation to the service.
Who gets targeted
Messaging and social account users, group members, and anyone receiving an unexpected verification request.
Protect yourself: The Ten-Minute Kit