Never share a verification code

What it can look like

Red flags

• Anyone asks you for a code you just received: by phone, text, email or chat.
• The code arrives when you weren’t trying to sign in to anything.
• They say it’s to “verify you”, “cancel a charge”, “stop a hacker” or “send you a refund”.
• Someone sends you a code “by mistake” and asks you to forward it.

What to do

1. Never read out, type or forward a code to anyone who contacts you. Not even “your bank”.
2. Only type a code on the website or app you opened yourself, a moment ago.
3. If a call worries you, hang up and call the number on your card or statement.

If you already paid, clicked or shared a code

Don’t panic, and don’t blame yourself. Act quickly, one step at a time.

• Call the company right away using a number you trust. Tell them you shared a code and ask them to lock the account.
• Change your password on the real website, and on any other account that uses the same one.
• Check for changes you didn’t make: new email address, new phone number, new payees.
• If it was your email account, check other accounts too, since email is used to reset passwords.
• Report it at ReportFraud.ftc.gov. If it was identity theft, IdentityTheft.gov gives you a step-by-step plan.

How Gmork Scam Guard helps

Gmork Scam Guard notices messages and pages that ask you to share a code, and warns you before you do. It works on your computer, not on your phone’s text messages, so the simple rule is the real protection: codes are never for sharing.

See what Gmork Scam Guard warns about and what it keeps private.

Questions people ask

The caller knew my name and my bank. Doesn’t that mean they’re real?

No. Scammers often know names, addresses and even which bank you use. A real bank will never ask for the code it sent you.

What if I typed the code into a page I reached from a text or email link?

Treat it as shared. Call the company on a trusted number and change your password on the real site.