I read out a one-time passcode — what happens now?

One-time codes are effective, which is why criminals need you to read them out. The request always comes with a reason — proving you are a real seller, confirming a refund, verifying an account, releasing a delivery — and none of those reasons exist. Nothing legitimate ever requires you to tell somebody a code sent to you.

Safety

Step by step

1. Re-read the message that contained the code.Almost all of them say what they authorise: a payment of a stated amount, a new payee, a login from a new device, a password reset, or registering an account with your number. That tells you exactly what to act on.
2. If it was banking, ring the bank now.159, or the number on the back of your card. Tell them a code was disclosed and what it appeared to authorise. Ask them to block any pending payment, remove any new payee and check for new device registrations.
3. If it was an account login, change that password immediately.From a device you trust, not the one you were being talked through. Then use "sign out of all sessions" in the security settings, because a password change alone does not always end an existing session.
4. Check for the changes attackers make next.New recovery email addresses and phone numbers, mail forwarding rules and filters, new trusted devices, new payees, changed delivery addresses. These are how access is kept after the password changes.
5. If it registered a messaging account, reclaim it.Re-register the app with your own number to take it back, and turn on the app's two-step verification PIN so it cannot be repeated. Warn your contacts, because your account will already be messaging them asking for money.
6. Turn on a stronger second factor.Where the account offers it, replace SMS codes with an authenticator app or a passkey. Codes that arrive by text are the ones that can be talked out of people.
7. Watch the accounts for a few weeks.Statements, sign-in activity, and any messages about applications you did not make. Disclosure of a code is often one step in a longer attempt.
8. Report it.Action Fraud, or Police Scotland on 101 in Scotland. Forward the scam text to 7726 if it came by message.

Tips

• The code message itself almost always contains a warning line saying nobody will ever ask for it. That line is there because this is the single most effective request a criminal makes.
• A caller who says the code is "to verify you are the account holder" is describing the opposite of what is happening — the code proves to the service that whoever holds it is you.
• If you were talked through it while on a call, expect the caller to ring back with a new story. Do not answer; ring the organisation yourself.

Common mistakes

• Assuming the code expired and no harm was done — They are used within seconds. Check the account rather than assuming.
• Only changing the password — Sessions, recovery details, forwarding rules and registered devices all survive a password change. All four need checking.
• Reading out a second code to "cancel" the first — That is a standard follow-up and it authorises something else. There is no code that cancels a code.

Questions people ask