Scam Alert
If a text message with a security code lands on your phone and somebody then asks you to read it out, slow down straight away. This is one of the most common ways criminals try to get past the final safety check on a bank payment, a card added to a digital wallet, or a sign-in to an online account.
The message itself can be genuine. The person asking for the code may not be. That is why this situation catches people out.
The short version: never read out a one-time passcode, verification code, or security code to someone who contacted you. Only enter a code into the app or website you opened yourself as part of something you started.
What a one-time passcode is for
A one-time passcode is a temporary code used to confirm it is really you. Banks and account providers may send one when you sign in, make a payment, reset a password, or approve a new device.
UK Finance explains that customers may receive a passcode by text or another verification method when banking or shopping online. In other words, the code is meant to help you confirm your own action.
Important: a real code can still appear during a scam. The text message may be genuine, but the request to read it out can still be criminal.
When a request for the code is not normal
A genuine code is normally entered by you into a checkout page, banking app, or sign-in screen that you opened yourself. It is not something a bank worker, police officer, delivery company, broadband provider, or “fraud team” should need you to read out over the phone.
If a person is talking to you while the code arrives, treat that as a warning sign. They may have triggered the code themselves and are now trying to use you to complete their scam.
Common examples of this scam
- A caller says they are from your bank and asks you to confirm a code to stop fraud.
- A text says your card was added to Apple Pay or Google Wallet and a caller then asks for the code.
- An email or caller says your account needs urgent verification and asks for the code you have just received.
- A scammer pretends to be helping you recover an account but is really trying to take it over.
If the message mentions your card being added to a digital wallet, our guide on what to do if your bank says your card was added to Apple Pay or Google Wallet covers that specific version in more detail.
Warning signs that the request is a scam
- You did not start anything just before the code arrived.
- You were contacted unexpectedly by phone, text, email, or WhatsApp.
- The person tries to rush you or says the code must be shared immediately.
- You are told the code is needed to cancel fraud or keep your money safe.
- You are asked to move money, install software, or stay on the line while the checks happen.
- The message says “do not share this code” but the caller still asks for it.
Take Five’s consumer fraud guidance highlights this exact risk and says criminals may try to trick you into sharing a one-time passcode, password, or PIN.
What to do right away
- Do not read out the code.
- Do not tap any links in the message.
- End the call or stop replying.
- Open the official app or website yourself if you want to check whether anything is wrong.
- Contact the organisation using details you found yourself, not the number or link in the message.
If the person claimed to be from your bank or broadband provider, our guide on how to check if a bank or broadband support call is real is a sensible next step.
A simple rule to remember: if you did not begin the sign-in, payment, or password reset, the safest answer is do not share the code.
What if the code came from your real bank or account provider?
That can happen. The code may have been triggered by a criminal trying to sign in or approve something using your details. A genuine code does not make the caller genuine.
The safe approach is:
- Ignore the caller’s instructions.
- Open your banking app or account the normal way.
- Check for alerts, recent activity, or unfamiliar devices.
- Contact the bank or provider directly using the app, the back of your card, or another trusted route.
This is the same calm approach that helps with suspicious emails too. If the situation started with an unexpected reset message, see how to check if a password reset email is real before you click.
If you already shared the code
Act quickly, but do not panic. Many people only realise what happened a few minutes later.
- Contact your bank or account provider immediately.
- Explain that you shared a one-time passcode during a suspected scam.
- Ask them to secure the account, card, or wallet token if needed.
- Change your password if the code related to an online account.
- Check recent activity for anything you do not recognise.
The National Cyber Security Centre says that if you have been tricked into sharing sensitive information, you should take immediate steps such as contacting your bank and changing passwords on affected accounts.
How to report the message or call in the UK
Reporting helps protect other people too.
- Forward suspicious text messages to 7726, the free reporting service used by most UK phone providers.
- Forward suspicious emails to report@phishing.gov.uk.
- If money was lost or you responded to a scam call, report it through Report Fraud in England, Wales, and Northern Ireland, or to Police Scotland in Scotland.
If you also tapped a bad link before noticing the problem, our guide on what to do after tapping a suspicious link on your phone covers the next checks calmly and step by step.
Small habits that make this scam less likely to work
- Pause when a code arrives unexpectedly.
- Keep 2-step verification switched on, but remember the code is for your use only.
- Check account activity inside the real app or website, not from a message link.
- Be extra cautious if somebody keeps you talking while messages arrive on your phone.
- Ask a family member or trusted helper for a second opinion if you feel pressured or unsure.
If you want a safer setup after a scare, our guide on turning on 2-step verification for your email account explains the protective side of these codes without the jargon.
A calm way to think about it
A one-time passcode is not proof that the person contacting you is real. It is simply proof that somebody started a process.
Your job is not to obey the first person who tells you what the code means. Your job is to stop, keep the code to yourself, and check the situation through a route you already trust.
When patient support helps
These scams are unsettling because the texts often look official and arrive at exactly the wrong moment. Many independent clients and families just want somebody calm to sit with them, check the account properly, and explain what happened in plain English.
Simply Tech Support helps with suspicious texts, scam calls, password worries, online banking confidence, and practical one-to-one support at home. You can read more on the Simply Tech Support services page.
Sources
- Take Five: Protect yourself
- Take Five: Digital wallet fraud
- Take Five: Card fraud
- UK Finance: Strong Customer Authentication frequently asked questions
- National Cyber Security Centre: Report a scam text message
- National Cyber Security Centre: Report a scam email
- National Cyber Security Centre: If you have shared sensitive information
