Get it free Try it on Telegram

Verification-code scam

OTP scam · One-time code scam

A verification-code scam tricks you into handing over a one-time passcode (OTP) sent to your phone or email. By then the scammer has usually already entered your username and password, or set off a password reset, and only needs the code texted to you to finish the login or account change. With an invented reason to ask for it, they take over your account, phone number, or payment app.

How we check this: Written and reviewed by the Hunch team; recognition signs reflect how the FTC/FBI describe this scam. · Last reviewed: 2026-08

Check a suspicious message now

Detection runs 100% locally on your device. We store nothing.

Please don’t paste other people’s personal data. Detection runs 100% locally on your device, and we store nothing.

Or try a real one:

Get it free

Or check it on Telegram

Example

Someone posing as your bank, a marketplace buyer, or a support agent says they need to 'verify it's really you' and that a code was just sent to your phone. In reality, they triggered the code by trying to log in or reset your password, and reading it back hands them your account.

How to recognize it

  • Someone asks you to read back a verification code that was just texted or emailed to you.
  • The request comes with a pretext: 'to verify your identity,' 'to confirm you're a real seller,' or 'for security.'
  • You receive a code you didn't request, then get contacted about it.
  • There's urgency and a warning that your account or money is at risk if you don't share it now.

How Hunch flags it

Hunch keys on signal categories that mark these attempts: an explicit request to share a one-time code or credential, urgency and security-themed pretexts, and contact from a source that can't be verified as the real account provider.

FAQ

Why do scammers want my one-time verification code?

Because it's the final step to log into your account or approve a change. If they already have your password or triggered a reset, the code is all that stands between them and full access.

I gave someone my verification code, what should I do?

Act quickly: change the account password, sign out all sessions, re-enable or reset two-factor authentication, and contact the provider. If it involved your phone number or bank, alert your carrier or bank about possible takeover.

Related