Got a verification code you did not request? Here is what to do

An unexpected one-time password (OTP) can have several explanations: someone entered a phone number incorrectly, someone attempted to register or recover an account, a delayed message arrived, or the service has a delivery problem. The message alone does not establish which explanation is correct. It also does not, by itself, prove that someone accessed your account.

Do not share or forward the code

Do not give the code to a caller, a social-media account, or someone claiming they sent it to you by mistake. Do not post a screenshot containing the code. If you did not start the action, do not enter the code to approve it. You do not need to complete someone else's registration or recovery request.

Open the app yourself

Use the app you already installed or navigate to the service's verified website. Avoid a link or support number supplied in the unexpected message. Review your transaction history and any available account-security activity. If you find an unfamiliar transaction or account change, report that specific event immediately.

What to send to support

• The service name shown in the message.
• When the message arrived and whether it has happened repeatedly.
• Whether you have an account and whether you initiated any sign-in, registration, or recovery action.
• A redacted screenshot if needed, with the OTP and unnecessary personal information removed.

Ask the provider to investigate why the message was sent and whether an account action succeeded. Only the provider's records can resolve that question. Do not assume a repeated code means a successful login, and do not accept a claim that everything is safe without an investigation when account activity looks unfamiliar.

If you already disclosed the code

Stop communicating with the requester. Contact the service through its official channel immediately and explain what action the code appeared to authorise. Change a compromised password through the official app, review available sessions, and follow the provider's recovery instructions. If funds moved without your permission, report the transaction details promptly. Recovery or reimbursement is not guaranteed.

Make the next attempt harder

Use a unique password where supported, keep the app and device updated, and enable additional authentication when the service offers it. NIST's phishing guidance recommends verifying suspicious requests through a known contact method and using multifactor authentication. An authenticator code is still confidential; an extra security step does not make sharing codes safe.