One-time passcode (OTP) scam

Someone talks you into reading out the six-digit code you just received.

How it works

The scammer already has your email or phone number and triggers a genuine login or password reset. The code that arrives is real — it's the last thing standing between them and your account. So they call, text, or message you with a story about verifying your identity, and ask you to read it back.

Red flags

A code arrives when you weren't logging in to anything
Anyone at all asks you to share or type in that code
'Reply with the code to confirm you're not a bot'
Pressure to act before the code expires

Real-world example

"Amazon Security: We detected a login from a new device. Reply with the 6-digit code we just sent to cancel it."

What to do

01Never share a one-time code with anyone, by any channel, for any reason.
02If an unexpected code arrives, change that account's password right away.
03Turn on an authenticator app instead of SMS codes where you can.
04Check the account's active sessions and sign out unknown devices.

Related scams

SIM swap fraud

Your phone number is ported to a scammer's SIM, and your codes go with it.

Email phishing

Fake emails impersonating brands to steal credentials.

Got a message that looks like this?

Paste it into the detector for a personalised analysis and next steps.

Open the detector