Never give a verification code to someone who calls or texts you: This is important even if they claim to work for your bank or another company you trust.
The timing can make the scam especially convincing: A scammer may be trying to access your account at the same time the verification code lands on your phone.
An unexpected verification code is a warning sign: Don't share it; instead, go directly to the company's official app or website and check your account.
You request a verification code. Your phone dings. Then, seemingly out of nowhere, you get a call or text from someone asking you for that code.
Coincidence? Maybe not.
Consumer advocate Lori Fullbright recently warned her followers on Instagram about an increasingly important rule for protecting your online accounts: Never share a verification code with anyone.
And the timing of these scams can make them particularly convincing.
A criminal may already be attempting to log into your account, reset your password, or set up an account using your information. That action can trigger the legitimate company to send a verification code to your phone.
The scammer doesn't necessarily get some special notification that you received the code. In many cases, they know it's arriving because they're the person who triggered it.
That's when the phone call or text can come.
Why they desperately need your code
Think of your verification code as the second lock on your front door.
The Federal Trade Commission (FTC) explains that your password is one key and your verification code is another. Even if a scammer has managed to obtain your password, the verification code can prevent them from getting inside your account.
That's exactly why they want you to hand it over.
The scammer might call pretending to be your bank's fraud department and say the following, "We just sent you a six-digit security code. Can you read that back to me so I can verify your identity?"
It sounds reasonable on the face of it, but the scammers may already be at a verification screen, waiting for you to hand over the code that they need to get into your account.
Give it to them and you may have just helped them get past the security system designed to keep them out.
The FTC's advice couldn't be simpler: Never give your verification code to someone else. Anyone asking you for an account verification code is a scammer.
Pay attention to the timing
This is one of the biggest clues consumers can watch for.
If a verification code arrives that you didn't request, somebody else may be attempting to access an account associated with your phone number or email.
And if a stranger calls or texts around the same time asking you for that number, don't assume the person is responding to a security alert. They could be the reason you got the alert in the first place.
Pro tip: It’s also smart to never approve a login notification you didn't initiate. Tapping "Approve" on an authentication request can potentially accomplish the same thing as handing over a code.
Read the entire verification text
Most of us see a verification text and immediately hunt for the six-digit number. Instead, you’ll want to slow down and read the rest of the message. Security messages often tell you what the code is for and warn you not to share it.
Heed that warning, as a legitimate employee will never call or text you asking for a code. Think of it this way: They would basically be asking you to defeat their company's own security system by reading them the secret code it just sent to you.
If someone asks for it, always end the conversation.
What if you actually requested the code?
There's an important distinction.
If you opened your bank's app, entered your password, and requested a verification code, it's perfectly normal to receive one.
Enter it yourself into the app or website you were already using. Don't give it to another person.
The FTC says verification codes exist specifically to prove that the person logging into the account is really you.
Already shared it? Don't wait
If you've given a verification code to somebody and then realize something isn't right, you’ll want to act immediately.
Start by changing the password on the affected account and make it unique from any other password you’ve used elsewhere. Use a password generator to help with this.
Then you’ll want to login to that account and check for any unfamiliar devices, password changes, purchases, transfers, or changes to your phone number or email address.
Also, when contacting a financial institution, get in the habit of always contacting the bank or card issuer using the phone number on the back of your card, on your statement, or its official app.
Never call a number supplied by the person who contacted you. And never trust caller ID as proof you're speaking with your bank, as caller ID information can easily be spoofed these days.