Login Code Scams: Keep Your Account Codes Private
Login code scams often begin with a request that sounds small. Someone asks you to pass on a code from a text message, or says they need it to check that you are real. Read the message that contains the code. If it grants access to an account, keep it out of the conversation.
Check what the code is actually for
A sign-in code can act as a second check when someone enters an account. The FTC explains these methods in its two-factor authentication guide. That code belongs in the official sign-in process you started.
A message saying “I sent my code to your number by mistake” does not change what the code can do. Read the service name and the purpose shown in the original notification. Avoid forwarding it to resolve someone else’s story.
Pause if you did not start a sign-in
An unexpected message is a reason to check your account through its usual app or website. Use a route you already know. Avoid following a new link supplied by the person who is asking for the code.
The FTC’s phishing guidance explains why a familiar-looking message can still lead to a false page. A logo at the top of a screen does not replace checking where you are signing in.
Keep proof-of-identity requests separate
A new chat partner may say the code will prove you are a real person. You can decline that request without offering a different secret instead. Account access is not something another user needs to assess your conversation.
The chat verification scams guide also covers requests that send you to paid or unfamiliar verification pages. Here, the immediate issue is a code that may let someone enter or change an account you use.
Act promptly if you already shared one
Open the affected service yourself and follow its account recovery guidance. Review access from other devices where that option is available. Change the password through the official settings and check whether the recovery contact details are still yours.
Ask the service for help through its own support route if you cannot sign in. Someone contacting you privately with a promise to recover the account should not receive another code or your password.
Set up recovery while you still have access
Use a recovery method you can keep secure and access when needed. For Snapchat, read the two-factor authentication guide. Telegram users can review two-step verification separately.
If the account requesting the code seems automated, you still do not need to investigate it before declining. The guide to recognising a bot in chat explains why the request matters more than guessing who wrote it.
Can I share an old code after it expires?
Keep the habit simple and leave account codes private. There is no useful reason to train a new contact to ask for them, and you may be mistaken about which code is still usable.
What should I say when someone keeps asking?
“I keep account codes private.” That is enough. If the requests continue, end the exchange and report the behaviour through the service where it happened.