Someone may know a password
A correct password can lead to the second security step, causing a code to be sent to the account holder.
Technology, platforms and channels
Why did I receive a verification code I did not request?
An unexpected verification code can mean that somebody tried to sign in, reset access or complete an action using your contact details. It can also result from another person entering the wrong phone number or email address.
Page P-012Guidance pageReviewed 29 August 2026
Key Guidance
Do not share the code or approve the request. Open the relevant account independently, review recent security activity and protect it if the attempt is not yours. A genuine support worker should not need you to read out a code created to authorise your action.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
A verification code is evidence that a process was triggered. It does not, by itself, explain who triggered it or whether they already know a password.
A reset may have been started
Account-recovery and password-reset processes can also generate codes before access is granted.
The contact detail may be mistyped
Another customer can accidentally enter your number or address. Repeated or related activity still deserves attention.
The code may support a separate transaction
A code can approve a payment, new device, changed setting or identity check rather than a simple login.
Consequences and movement
What may happen next
The safest response is to inspect the genuine account and understand what the code was meant to authorise—without entering through the message.
A follow-up request
A caller or message may claim that the code is needed to cancel fraud, verify identity or stop a delivery.
An account alert
The genuine service may show a new login, device, recovery method, password change or transaction attempt.
Repeated attempts
Several codes can indicate repeated login or reset activity and may be followed by targeted contact.
A successful intrusion
If the code was shared or an approval was accepted, the account may need immediate recovery and session review.
Practical response
What you should do
Start inside the account or service named by the code. Do not answer through the notification or a person who contacts you about it.
- Do not share or enter the codeIgnore requests to read it aloud, send a screenshot, copy it into a link or approve a prompt you did not start.
- Open the account independentlyUse the genuine app or a saved address and inspect recent logins, devices, transactions and security changes.
- Read what the code authorisesThe message may identify a login, reset, payment or device. Do not assume all verification codes have the same purpose.
- Change compromised credentialsIf activity is unexplained or a password may be known, change it from a trusted device and change it anywhere it was reused.
- Strengthen and review recoveryUse two-step verification or a passkey where available, remove unknown sessions and confirm that recovery details remain yours.
- Recover access promptlyIf you shared the code or lost access, use the provider’s official recovery process and contact the bank at once if a payment is involved.
Look more closely
The code may be genuine even when the explanation is false
An unexpected code can result from a real login or payment attempt. Do not share or approve it for someone who contacts you. Review the relevant account directly and secure it if necessary.
A real code or approval notification arrives unexpectedly.
Concern about account loss or a fraudulent transaction demands attention.
A caller claims to be support, security, a bank or another trusted service.
The person instructs you to reveal the code or approve an action.
Checking the account independently separates the real event from the false helper.
Selected history
Historical cases and lasting lessons
One-time-code phishing
Criminals who get or guess a password may attempt to collect the second factor through a false support or security story.
Lasting lesson: A code protects the account only while it remains with the person authorising the genuine action.
Credential reuse after breaches
Passwords exposed elsewhere may be tried against other accounts, generating genuine security prompts and codes.
Lasting lesson: Use a unique password and protect the account named by the alert rather than responding to an unknown contact.
Transferable understanding
Patterns over time
A real message can support a false caller
The code proves a system event happened, not that the person discussing it is authorised.
The stated purpose may be reversed
A code described as cancellation may actually approve the action the scammer wants.
Urgency compresses interpretation
People may follow the caller’s explanation without reading the code’s own description.
Account recovery is part of security
Unknown recovery details or active sessions can preserve access after a password change.
Plain-language answers
Common questions
Does the code prove someone has my password?
Not always. A reset, mistyped number or other process may generate it. Review the account to confirm what happened.
Can support ask me for part of the code?
Do not disclose a code created to authorise a login, payment or security change. Use the provider’s official support route if uncertain.
Should I change my password immediately?
Change it if the account shows unexplained activity, the password was reused or you have reason to think it is known. Review sessions and recovery details too.
What if I already shared the code?
Treat the intended action as potentially approved. Recover the account, review activity and contact the relevant payment provider at once if money is involved.
Use the genuine account’s security and recovery route
The service that generated the code can show what it was intended to approve. Reach it independently, secure the account and report any resulting fraud through the appropriate route.
Scamology Insights
Separate the genuine code from the claimed helper
These learning resources can help you recognise when a real security event is being used as the claimed identity for an unauthorised login, payment or account change. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency