What to do if you gave a scammer a one time code
If you gave a scammer a one time code, treat the account as exposed.
The code may have helped them log in, add a device, reset a password, approve a transfer, or change security settings. Do not keep texting them. Do not argue. Do not send another code.
Go to the real app or website yourself, or call the bank from the number on your card.
What the code may have done
| Code was for | What may have happened | First move |
|---|---|---|
| Bank login | They may have logged in | Call the bank now |
| Card or transfer approval | They may have approved a payment | Ask the bank to review transactions |
| Email login | They may control your reset key | Change email password and revoke sessions |
| Phone carrier | They may try SIM swap or account changes | Call your carrier |
| Social account | They may take over the account | Change password and remove unknown devices |
Do this now
- Stop talking to the scammer.
- Open the real app yourself.
- Change the password for the affected account.
- Sign out of unknown devices.
- Remove unknown recovery emails or phone numbers.
- Call the bank, carrier, or platform if money or identity is involved.
- Save screenshots of the message and number.
- Report the scam.
If this was a bank code, call the bank first. Password cleanup can wait ten minutes. Unauthorized transfers cannot always wait.
Change these passwords next
Start with:
- Email.
- Bank and payment apps.
- Apple ID or Google account.
- Phone carrier account.
- Password manager.
- Social accounts.
Use unique passwords. If you reused the same password anywhere, change it there too.
How to avoid the next code trap
The rule is simple:
No one gets a code you did not ask for.
Not your bank. Not "fraud support." Not a delivery company. Not someone claiming to be your child. Not a buyer on Marketplace. Not a caller who says they need to "verify" you.
If someone needs a code from you, the safest answer is no.
Sources
- FTC, what to do if you were scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
- FTC, recognizing and reporting spam text messages: https://consumer.ftc.gov/articles/how-recognize-and-report-spam-text-messages
- NIST SP 800-63B authentication guidance: https://pages.nist.gov/800-63-4/sp800-63b.html