That Security Code Is for You—Not the Caller

Key Takeaways

• One-time passcodes are designed to confirm your identity.
• A caller asking you to read back a security code may be trying to access your account.
• Caller ID alone doesn’t prove who is contacting you.
• End suspicious calls and contact the organization directly.

Main Article

Your phone buzzes with a six-digit security code. Seconds later, someone claiming to be from a familiar company calls and asks you to read the number back to “verify your account.” It can sound completely reasonable—but that code may be the final piece a scammer needs to get into your account.

One-time passcodes and verification codes are commonly used as an additional layer of account security. If someone else is attempting to log in using your username and password, they may trigger a code that’s sent directly to you. Convincing you to share it can allow them to complete the login.

Don’t assume an incoming call is legitimate because the caller ID displays a familiar business or financial institution. Caller ID information can be manipulated. If you’re unexpectedly asked for a code, password, PIN or other sensitive information, end the call rather than continuing the conversation.

Then contact the company directly through its official app, website or a telephone number you know is legitimate. And if you receive a security code you didn’t request, consider it a reason to review the affected account. A one-time code is meant to protect you—keep it that way by keeping it to yourself.