Why a stranger asks you for a six-digit code, and why you never give it

A message arrives from a friend, or from someone buying the bike you listed online: "I sent you a code by mistake, can you forward it to me?" Or: "Before I pay, I need to check you're a real person. I've sent you a code." A text with six digits follows.

That code is the key to one of your accounts. The person asking for it is trying to take that account.

What the code really is

When you sign in to a service, or set up an app on a new phone, many services send a one-time code to your phone number to prove the phone is yours. Whoever types the code in gets the account. The service has no way to tell whether the person typing it is you.

So the trick is never technical. It's a story that makes forwarding the code feel normal:

• "I sent it to you by mistake." The message often comes from a friend's account that has already been taken over, which is why it sounds like them.
• "I need to verify you're real." Common when you sell something online. The US Federal Trade Commission describes this as the Google Voice verification scam: the code sets up a phone number in your name, which the scammer then uses to cheat other people.
• "This is support, we need to confirm your identity." Real support teams never ask for these codes.

What happens next

With a messaging account such as WhatsApp, the scammer registers your number on their own phone and you are signed out. They can then message your contacts as you, usually asking for money, or for the next person's code. Each stolen account is used to steal the next one, which is why these messages so often seem to come from people you know.

The rule

The FTC's advice is short: "Never give your verification code to someone else. It's only for you to log into your account." (FTC)

There is no exception for friends, family, buyers or support staff. If a code arrives that you didn't ask for, someone is trying to sign in as you. Ignore it, and don't reply to whoever asks for it.

Make the code alone useless

• WhatsApp: turn on two-step verification (Settings → Account → Two-step verification). It adds a PIN that is asked for whenever your number is registered on a new phone, so a stolen six-digit code isn't enough. Add an email address so you can reset the PIN if you forget it.
• Everywhere else: use an authenticator app or a passkey instead of text-message codes where you can. Our guide to passkeys explains why they can't be phished like this.

If you already sent it

1. Act fast. For WhatsApp, open the app and register your number again with the six-digit code you receive. That signs the other person out, even if they set a two-step verification PIN. If WhatsApp then asks for a PIN you don't know, you have to wait 7 days before you can get back in without it.
2. For other accounts, use the service's "forgot password" or "account hacked" page right away, then change the password and sign out other devices.
3. Warn your contacts through another channel that messages from your account may not be from you.
4. If money was involved, call your bank on the number printed on your card.

This address used to carry a 2017 news report about a phishing attack on Facebook's "Trusted Contacts" recovery feature, which Facebook has since retired. This is a new article on the same kind of attack, written in October 2026.