One-Time-Code / 2FA Social Engineering
A scammer triggers a real one-time code to your phone, then calls or texts pretending to be the company and asks you to read it back — using it to break into your account.
Think a message like this reached you? You can check it right now.
What this scam is
The scammer already has your username and password (or is resetting your account) and just needs the one-time code (OTP/2FA) that the real company texts you. Posing as your bank, Amazon, or Google 'security,' they call or text and ask you to confirm or read back the code that 'was just sent to verify you.' Reading it aloud hands them the final key to your account. No legitimate company asks you to share a code they sent you.
What it usually looks like
- A one-time code arriving that you didn't request.
- A caller/texter asking you to read it back to 'verify you.'
- Urgency about securing your account or a charge.
- A story that makes sharing the code seem safe.
Common warning signs
- Anyone asking for a code that was texted to you.
- A code arriving right before or during the call.
- Pressure to confirm quickly.
- 'Verification' that requires you to share the code.
Example wording scammers use
“To verify your identity, read me the 6-digit code we just texted you.”
“We sent a code to stop the fraud — confirm it so we can secure your account.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Your one-time 2FA code.
- The final key to log into your account.
- To act while the code is valid.
What to do
- Never share a one-time code with anyone, ever.
- Hang up and contact the company through official channels.
- Treat an unexpected code as a sign someone has your password — change it.
- Use app-based authenticators or security keys.
What to do if you already responded
- Change the account password and revoke sessions immediately.
- Contact the company's real support to secure the account.
- Report at reportfraud.ftc.gov and ic3.gov.