Phishing & Scams

The Verification Code a Stranger Asks For — Why You Should Never Share It

A buyer, a "friend," or a "bank representative" asks you to share a code that just arrived on your phone. Here's exactly what they can do with it and why the request is always fraudulent.

By AdsBlocks Team·October 21, 2026

The Verification Code a Stranger Asks For — Why You Should Never Share It

The Setup

You're selling something on Facebook Marketplace, Craigslist, or OfferUp. A buyer messages you. They seem legitimate. They say they want to verify you're a real person before they meet to buy the item.

"I just sent you a code to verify your number. Can you read it back to me?"

A code arrives. You share it. The "buyer" disappears — and so does access to your Google Voice account, Gmail, or phone number.

This same script plays out in dozens of variations.

What the Code Actually Is

That text message is a verification code for an account registration or login that the attacker is trying to complete. When you read it back, you've just handed them the one thing standing between them and access.

Common targets:

Google Voice: The attacker registers a Google Voice number tied to your phone number. They can now make calls and send texts that appear to come from your number.

WhatsApp: WhatsApp verification codes let an attacker take over your account entirely, including your message history and contacts. They'll then run scams targeting your contacts.

Email account recovery: If your email uses your phone number for recovery, this code is what stands between the attacker and your inbox.

Bank and financial accounts: SMS codes are used for password resets and transaction authorization.

Why There's No Legitimate Reason to Ask for Your Code

Verification codes are designed to be secret. The system they protect only works because only you receive the code. There is no scenario where a legitimate person — a buyer, a potential employer, a bank employee, a friend — needs to know a code that was sent to your phone.

If someone needs to verify your identity, they can ask you questions or conduct the verification through official channels. They never need a code that appeared on your screen.

Other Variations of This Attack

"I accidentally sent a code to your number": Impossible. Codes are sent to specific registered numbers — no one sends a code to a random number by mistake.

"Your account was flagged and we need to verify you with the code we just sent": A real bank can verify you by asking account-specific questions. They never need a code that was just sent to your phone.

"I'm your friend, I need help — I was locked out and the code went to you": A SIM swap or number port attack means their calls and texts now go to your number. But they can't receive your verification code from their old number — this story makes no sense.

What to Do

Never share any code that arrives unrequested or was triggered by someone else's action

If a code arrives without your action, someone is attempting to access an account — log in directly and review recent activity

Hang up or close the chat — no explanation, no argument

Bottom Line

Any code that arrives on your phone is meant for your eyes only. The moment anyone asks you to read it back, you're being targeted. Hang up.

Protect Yourself Today

The #1-rated antivirus covers all the threats mentioned in this article.

Get TotalAV — $1.99/month →