Short answer
A verification code is a key to your account: whoever types it in proves they are you. Scammers ask for it with a story — a friend who “sent a code to you by mistake”, a Marketplace buyer who wants to “check you’re real”, someone who “found your pet”, or fake support. The FTC’s rule: don’t share a verification code with anyone you didn’t contact first — “that’s a scam, every time”. If you already sent it: for WhatsApp, register your number again with a new SMS code at once, which signs out the other device; for Google Voice, reclaim your number through Google; for email and social accounts, change the password, end other sessions and check the recovery details. Then warn your contacts — hijacked accounts are used to ask the next person for their code.
Why a code is never “just a code”
A code sent to you by SMS, email or an app is a one-time proof that you are you. Depending on where it comes from, it can register your WhatsApp on someone else’s phone, set up a Google Voice number linked to your phone number, reset a password, approve a new login or confirm a payment. That is why WhatsApp, Google and banks all tell you never to share it — and why genuine support staff never ask you to read one back.
The scripts scammers use
| What they say | What is really happening |
|---|---|
| “Sorry, I sent you a code by mistake — can you forward it?” | It is your own WhatsApp registration code, often requested from a friend’s hijacked account. Forwarding it moves your account to their phone |
| A buyer, or someone who “found your pet”: “I need to check you’re real” | They are creating a Google Voice number linked to your phone number, the FTC warns |
| “Support” or a “security team” asking you to confirm a code | Real support doesn’t ask for codes: this is an account takeover in progress |
| “Vote for me in a competition — just send the code you get” | The “vote” is a sign-in or registration code for your account |
| Your bank’s “fraud team” asks for a code to cancel a payment | The code approves a payment or adds a device to your banking. Hang up and call the number on your card |
If you already shared the code
- WhatsApp: open WhatsApp on your phone and register your number again with the new 6-digit SMS code. That signs every other device out of the account. If the scammer set a two-step PIN you don’t know, you may have to wait before you can register without it. Details in WhatsApp hacked.
- Google Voice: the FTC points to Google’s steps to reclaim your number; you can start from Google Voice’s reclaim page.
- Email, social media and other accounts: from a device you trust, change the password, sign out of other sessions and check the recovery email, phone number and forwarding rules. See where to check logged-in devices.
- A bank code: call your bank straight away on the number on your card and ask it to block the payment or the new device.
Warn others and stop the chain
- Tell your contacts from another channel that messages from your account may not be yours — a hijacked WhatsApp is used to ask your friends for their codes or for money, the pattern behind the “Hi Mum” scam.
- Report and block the scam account in the app it came from.
- Report it — in the US at ReportFraud.ftc.gov; elsewhere to your national fraud service.
- Watch for follow-ups: whoever has your number may try more codes over the next days.
Make codes harder to steal
- Turn on WhatsApp two-step verification (Settings → Account) so a registration code alone is not enough, and check Linked devices regularly.
- Use an authenticator app or passkeys for email and important accounts instead of SMS codes.
- Set a PIN on your voicemail — codes delivered by voice call can be read from an unprotected voicemail box.
- Ask your mobile provider about SIM-swap protection — see SIM swap: what to do.
- Only enter a code where you started the sign-in yourself, in the official app or website — never read one out to a person.
Frequently asked questions
A friend asked me to forward a code they sent “by mistake”. Is that safe?
No. The code is for your own account, and your friend’s account has probably been hijacked. Call your friend on a number you know before doing anything.
What can a scammer do with my Google Voice code?
According to the FTC, create a Google Voice number linked to your phone number, use it to scam others while hiding their identity, and try to access your accounts or open new ones in your name.
I shared my WhatsApp code. How do I get my account back?
Register your number again in WhatsApp with a new SMS code; that signs out the other device. If the scammer set a two-step PIN, you may have to wait before you can register without it.
Is it ever OK to share a verification code?
Only by typing it yourself into the official app or website where you started the sign-in. Never give it to a person — the FTC says sharing it with someone you didn’t contact first is a scam every time.
Sources: FTC — Google Voice scam: how the verification code scam works, Google Voice — reclaim your phone number, WhatsApp Help — recover a stolen account, WhatsApp Help — how to unlink a device, FTC — ReportFraud.ftc.gov