Your bank just texted asking for the code they sent you. Never send it.

The problem

A message arrives by text or WhatsApp, appearing to come from the bank. It warns of unusual activity on the account and asks for the six digit code that is "about to arrive," to "verify" the account before it gets locked. A minute or two later, a real code does show up, sent by the real bank, with the real sender name. That is what makes this version of the scam so effective: everything after the first message looks completely legitimate.

Reading that code back, or forwarding it, hands over the one thing standing between a scammer and the account.

How it can happen

The scammer already has enough to attempt a login: a phone number, and often a leaked username or partial account number bought from a data breach. What they do not have is the second piece, the verification code the bank sends only once someone tries to log in. So they trigger that login attempt themselves, which is why the real code lands moments after the fake "verify your account" message. The timing feels like proof it is genuine. It is actually proof the account is already under attack.

The FTC explains the mechanism plainly: a password and a verification code work together like a doorknob lock and a deadbolt, and a scammer who already has the password only needs the code to get all the way in. Anyone who asks for that code, by any channel, is a scammer, without exception.

How to avoid it

Never share a one-time code with anyone, for any reason, no matter how official the message looks or how urgent it sounds. A bank will never call, text, or message on WhatsApp to ask for a code it just sent. The code exists to prove identity to the bank's own systems, not to be repeated to a person on the other end of a message.

If a message claims something is wrong with an account, do not tap any link inside it and do not reply. Open the bank's official app directly, the same way it is opened every other day, and check for real alerts there. If nothing shows up in the app, the text was fake.

If a code has already been sent to someone by mistake, contact the bank immediately using the number on the back of a card or a recent statement, not any number from the message, and ask for the account to be secured.

Things to watch

• Any message asking for a code to be typed back or forwarded.
• A message that arrives right before, or right after, a genuine one-time code.
• A link inside the message instead of being asked to open the app directly.
• Urgency about account suspension or unusual activity.
• A sender name that looks right but a request no real bank would ever make.

The same trick shows up with a slightly different script asking someone to "verify" an account over WhatsApp before any code is even mentioned. See the WhatsApp account verification version of this scam for how that one opens.