Published on 2026-07-25
Someone is asking for the code that just landed on your phone. Now what?
A six-digit code just arrived by text, and a stranger on the line wants you to read it out. That single request is the whole scam. Here's why, and what it protects.
It usually starts somewhere ordinary: you're selling something online and a buyer seems keen, or your phone rings and a calm voice says there's a problem with your account. Then comes the small, oddly specific request. A code just arrived by text, they say, and could you read it back so they can confirm you're really you. It sounds like a minor favour. It is, in fact, the entire scam, packaged as a formality.
The code isn't a favour, it's the last lock on the door
A one-time code exists for a single reason: to prove that whoever is logging in, or setting up a new account, is holding your phone at that exact moment. Everything else, a password, an email, a phone number, can be guessed, bought or leaked. The code is the last piece a stranger can't get without you. That's precisely why they ask for it instead of trying to break in some other way. They don't need to hack anything if you'll simply hand them the one thing that was standing in their way.
The FTC has documented a version of this that specifically targets people selling items online: a 'buyer' asks for your phone number to text you a verification code, then asks you to read it back to 'confirm you're a real seller'. What's actually happening, per the FTC, is that the scammer is using your number to set up a Google Voice account in your name. Once they have that code, they can finish setting it up, hide behind your number, and, combined with a bit more information about you, open other accounts pretending to be you.
The code was never a test of who you are. It was a request for the one key they were still missing.
Why the story around it always sounds reasonable
What makes this work is how mundane the ask feels. Nobody storms in demanding your password. They ask for something that just arrived, that looks like a receipt or a formality, wrapped in a story that makes sense in the moment: a bank checking suspicious activity, a delivery service confirming your address, a buyer being careful before paying. AARP's Fraud Watch Network points out that most scams share the same three ingredients before the ask even arrives: contact you didn't expect, a jolt of emotion, and a push to hurry. Their advice is to take what they call an active pause right there, a moment to actually think before answering, rather than replying inside the emotion the caller just handed you.
- The request comes from someone who contacted you first, not the other way round
- A code arrives right as they're asking, as if on cue
- The reason given sounds procedural: confirm, verify, secure
- There's pressure to answer quickly, before you'd think to check anything
- You never asked your bank, your buyer or anyone else to send that code
The rule that costs nothing to follow
The good news is that this scam has exactly one weak point: it only works if you say the numbers out loud, or type them somewhere the caller can see. Cut that one step and the whole thing collapses. No bank, no delivery service, no genuine buyer on a marketplace ever needs a code that was sent to your phone, because that code was never meant to travel any further than your own screen. If a call or message asks you to share one, the safest reply is no reply at all: hang up, or simply don't send it, then contact the company yourself through a number or address you already trust, not one the caller just gave you.
It's a strange kind of protection, being this simple. You don't need to spot a fake voice or a clever fake website. You just need to remember that the code on your screen was written for your eyes, not for the person asking to borrow them.
It also helps to remember what's at stake once that number leaves your hands. A code shared in a rushed moment doesn't just unlock one small favour, it can hand over a phone number, an account, or a login that then gets used to reach your contacts, your bank, or the next person in line for the same trick. Slowing down for those ten seconds costs you nothing. Reading the code out loud, on the other hand, can cost a lot more than the sale or the phone call ever promised.