Accounts and money
Verification code and account recovery scams: never share the code
The short answer
Never share a verification code with anyone. The FTC says anyone who asks for one of your codes is a scammer (FTC).
If your account was hacked, recover it yourself through the company’s official website or app. Don’t pay anyone who contacts you offering to recover an account or lost money (FTC).
What a verification code is for
When you log in or reset a password, many sites send a short code by text, email, or app to prove it’s really you. That code is the key to your account. Whoever has it can get in (FTC).
How the scam works
- Someone messages you, sometimes from a friend’s hacked account, and says they sent you a code by mistake and asks you to send it back.
- Someone calls claiming to be from your bank or a tech company and asks you to ‘confirm’ the code they just sent.
- A person or ad offers to recover your hacked account, or money you lost, for an upfront fee (FTC).
In every version, sharing the code hands over your account (FTC).
If your email or social media was hacked
The FTC recommends these steps (FTC):
- Use the official recovery page of the email or social media company, reached by typing its address or using its app.
- Change your password to something long and unique. The FTC suggests at least 12 to 15 characters (FTC).
- Sign out of all other devices from the account’s security settings.
- Check your recovery email and phone number, and remove any you don’t recognize.
- Turn on two-factor authentication. An authenticator app is generally safer than text codes (FTC).
- Tell your contacts not to trust messages that came from your account while it was hacked.
Beware of ‘recovery’ services
Scammers target people who’ve already lost an account or money. They may pose as a government agency, a law firm, or a recovery expert, and ask for an upfront fee or your bank details (FTC). The FTC warns that people who’ve lost money to a scam should watch for scammers who say they can help (FTC).
Never move money ‘to keep it safe’
A related scam tells you your account is compromised and that you need to move your savings to a ‘safe’ account. The FTC says legitimate businesses and agencies will never tell you to do this (FTC).
Turning on extra login protection is one of the best defenses. CISA, the federal cybersecurity agency, explains how in Turn On MFA. See also is this a scam? and what to do after a data breach.
Common questions
Someone said they sent me a code by mistake. Should I send it back?
No. The FTC says anyone who asks for your verification code is a scammer (FTC). Ignore the message, and if it came from a friend’s account, let them know another way that they may have been hacked.
Is it safe to give a code to my bank on the phone?
No. If someone calls and asks for a code, hang up and call your bank at the number on your card (FTC).
How do I get my hacked Facebook or Gmail account back?
Use the company’s official recovery page, reached by typing the address yourself. Then change your password, sign out other devices, and turn on two-factor authentication (FTC).
Should I pay someone to recover my account or lost money?
No. Upfront fees for recovery are a classic follow-up scam (FTC).
Are text message codes safe?
They’re much better than nothing. An authenticator app is generally safer, because texts can be intercepted if someone takes over your phone number (FTC).
This page is general information, not legal or financial advice. If money already left your account, call your bank or card company first.