The six-digit code nobody should ever get

You know the message. Six digits, sometimes four or eight, and a line underneath saying not to share it with anyone. Most of us have stopped reading that line.

It is worth reading again, because it is the most literal warning any company will ever send you.

What the code actually is

Your password is the first key to your account. The code is the second one — and unlike the password, it changes every time and lands only on your own phone. That is the whole idea. Even if someone somewhere has your password, they still cannot get in, because the second key comes to you.

The scripts you are most likely to hear

Nobody says „please give me the key to your account". It always sounds like something else.

• „I'm just verifying you're a real person." Common when selling something online. The buyer says they will send a code to make sure you are not a robot. There is no such verification. They are creating an account in your name, or taking over one of yours.
• „This is the fraud department. Read me the code we just sent." No bank does this. They sent you the code precisely so that nobody else could have it — including them.
• „It's me, I'm locked out and the code went to your number by mistake." A message from a friend's account, in a friend's name. Their account has been taken over, and yours is next.
• „Please confirm the code so I can cancel the charge." Wrapped inside a story about a refund or an accidental payment.

The rule, in one sentence

Nobody legitimate ever needs a code that was sent to you. Not your bank, not the police, not Apple, not Amazon, not a colleague, not a family member, not the nice person buying your bicycle. There is no honest reason to ask. None.

Which makes this one of the easiest rules in the whole guide. You do not have to judge the story or weigh up how plausible the caller sounds. The request itself is the answer.

Why even a friend asking is a red flag

This is the part people find hardest, so it is worth saying plainly. When a message arrives from someone you know, it is natural to help. But an account that has been taken over still shows the right name and the right photograph, and the person writing to you is not your friend.

The way through is simple and costs nothing: call them. On the number you already have saved, not the one in the message. Ten seconds settles it, and if it really was them, they will understand completely.

A word about the code that arrives unexpectedly

Sometimes a code turns up when you were not doing anything at all. That is not harmless — it means someone is actively trying to get into that account, and they already have your password.

• Do not enter it anywhere, and do not pass it on.
• Change the password for that account straight away, from a device you trust.
• Start with your email if the code was for your email account. Everything else can be reset from there, which is why it is always the first target.

If you have already shared one

Move quickly, and do not spend energy on embarrassment. These scripts are written to work.

• Change the password of that account immediately, and any account using the same password.
• Check which devices are signed in. On an iPhone: Settings → your name → scroll down. Remove anything you do not recognise.
• Call your bank if the account was financial, on the number on the back of your card.
• Report it at reportfraud.ftc.gov.

And then tell one person you trust. Not because they can undo it, but because saying it out loud is how this stops being something you carry alone.