Why a Call Asking for Your Verification Code Is a Scam

The phone rings, or a text comes in. A moment later, a six-digit code shows up on your screen. Then someone — maybe from "your bank," "Apple," or "Amazon" — calls and asks you to read that code back to them, just to "verify your identity."

It feels routine. It is not. That code is the one thing standing between a stranger and your account, and the moment you read it out loud, you've handed it over.

This is called a verification code scam, and it's one of the most common ways accounts get broken into today. Here's how it works, and exactly what to say when it happens to you.

How the verification code scam works

A verification code — sometimes called a one-time passcode — is a short number your bank, email provider, or another account sends you by text or email to prove it's really you signing in.

The scam starts before you ever see the code. A criminal who already has your username, or just your phone number, tries to log into your account. Your bank or email provider, doing exactly what it's supposed to do, sends a verification code to your phone to confirm the login.

At the same moment, that same criminal calls or texts you, pretending to be from your bank, Apple, Amazon, or another company you trust. They say there's "suspicious activity" on your account and they need to "verify" you by reading back the code that was just sent. If you do, they type it into the login screen on their end — and now they're in your account, not you.

Why it's so convincing

The code itself is real. It really did come from your bank or your email provider, which is exactly why this scam works so well. You see a genuine code on your phone, a caller who sounds official is asking for it, and it's natural to think cooperating is the safe thing to do.

It's the opposite. A real bank, or Apple, or Amazon, will never call or text you and ask you to read a verification code back to them. The code exists so that only you — using your own phone, on the actual website or app — can finish signing in. No legitimate company needs you to say it out loud to anyone.

What to do if someone asks you for a code

1. Don't say the code out loud or type it anywhere, no matter how urgent the caller sounds.
2. Hang up. You don't owe a caller an explanation. If it's your bank, you can call them back yourself.
3. Call the company directly, using the phone number printed on your card or statement, or on their official website — never a number the caller gives you.
4. Change your password for that account if you're worried someone already has it, especially if you got a code you didn't request.
5. Tell a family member what happened, even if you didn't share the code. A second set of eyes helps, and there's no shame in asking.

A good rule to keep nearby: if a code shows up that you didn't ask for, someone else is trying to get into your account — not you. Don't act on the call; act on protecting the account.

What to do if you already shared a code

If you already read a code to someone, don't panic, and don't wait to see what happens. Call the bank or company right away using the number on their website or your card, tell them your account may be compromised, and ask them to secure it. Change the password on that account and on any other account that uses the same password.

If the scam involved letting someone remotely access your computer, or you're not sure what they were able to see or do, that's a good time to have someone look it over for you. We can help clean up after a scam in your home or remotely — you don't have to sort out what happened on your own.

A quiet way to stay ahead of scams like this

Verification code scams usually travel with other tricks — a scary pop-up, a fake tech-support call, an email made to look official — all designed to catch you off guard. PorchswingProtect is quiet, simple protection for your Windows or Mac computer, built for seniors, with a real Porchswing person you can call if something feels wrong. It won't ask you to read a code to anyone — the opposite is the whole point.

If you want quiet protection on your Windows or Mac computer — with a real Porchswing person to call — learn about PorchswingProtect. Or call us at (916) 521-0065 and we'll help you set it up.

Common questions

Can a verification code scam happen by text instead of a phone call?

Yes. Some scammers text you first, pretending to be your bank, and ask you to reply with the code. The same rule applies: don't send it. A real company won't ask.

What if the caller already knows my name, address, or part of my account number?

Scammers often have some of your real information already, from a data breach or a previous scam, which they use to sound convincing. Knowing a few details about you doesn't make the call legitimate — hang up and call the company back yourself.

Is it safe to give a verification code to someone I called myself?

If you called a company's official number yourself, and you're the one trying to log in, that's different — the code is confirming your own login. The danger is giving a code to someone who contacted you first, or to anyone claiming they need it to "verify" you over the phone.