By Alex Carter, Editor at GetVerifyCode
A random verification code text usually means someone typed your phone number into a sign-up or login form, either by mistake or on purpose. It can also mean someone has your password and is trying to sign in. Don't share the code or tap links in the text, and check the account yourself.
Key facts
- The OCC, a US bank regulator, says an authentication code is sent to verify an attempt to log in to your account.
- The OCC says that if you didn't just try to log in and a code arrives, a scammer may already have your username and password.
- The OCC says never to give an authentication code in response to texts, emails or phone calls, and that bank representatives won't call and ask for it.
- The OCC also says not to click links in unsolicited emails.
4 reasons you got a code you didn't request
A code you didn't ask for is a signal, not proof of a hack. These are the usual causes, from most to least harmless.
Someone mistyped their own number
People enter phone numbers by hand all the time. One wrong digit, or a missing country code, and the code lands on your phone instead of theirs. If you get one code and nothing else happens, this is the most likely reason.
Someone has your password and is trying to sign in
If the code names a service you actually use, take it seriously. The OCC's message on multifactor authentication and scams says that a code you didn't request can mean a scammer already has your username and password and is trying to get into the account. The code is the only thing stopping them.
A scammer is about to ask you to read the code back
A common trick: the code arrives, then a text or call follows, often pretending to be the company or a buyer on a marketplace, asking you to "confirm" the code. Anyone who asks you to read out a verification code is trying to use it. The real company doesn't need it from you.
Your number was recycled
Carriers reassign numbers that were given up. If your number belonged to someone else before, it may still be saved on their old accounts, so their sign-in codes reach you. See how to use an old phone number for verification for the other side of this problem.
What to do right now
- Don't reply with the code, and don't forward it to anyone.
- Don't tap any link in the text. Open the service by typing its address or using its official app.
- If you have an account there, sign in, change your password and review recent sign-in activity.
- Turn on a stronger second step, such as an authenticator app. Our guide to two-factor vs two-step verification explains the options.
- If you don't have an account there, you can usually ignore a single code. Delete it or report it as junk.
- If the text names a bank, wallet or payment app, contact that company directly through its own app, website or phone line.
Why do I keep getting verification code texts?
Repeated codes usually mean the same thing is happening again and again: someone keeps typing your number, a script is retrying a sign-in, or your recycled number is still linked to an old account. If the codes name a service where you have an account, treat it as a sign-in attempt and secure the account first. If you have no account there, contact that service's support and tell them your number is getting codes you didn't request.
Some brands get searched so often that we wrote separate guides:
- Google codes: why did I get a Google code I didn't request
- Link (Stripe) codes: why did I get a Link verification code text
- Shop codes: why you got a Shop verification code
- Coinbase codes: what a Coinbase withdrawal code text means
For anything financial, don't try to sort it out from the text. Contact the company yourself.
Codes from short codes and unknown numbers
Most verification codes come from short codes, the 5- or 6-digit numbers companies use for bulk texts, or from ordinary-looking numbers that a messaging provider rotates. Our guide to 5-digit phone number short codes explains how they work.
People often search the sender number itself, such as 65821, hoping to find out who sent it. The number rarely tells you much, because one short code can carry messages for many brands. The wording of the text, usually the brand name at the start, is the better clue. Don't call or text the number back to ask.
Keeping your personal number off sign-up forms
Every form that collects your number is another place it can be mistyped, leaked or reused. For low-risk sign-ups, such as a trial, a one-off newsletter or testing your own app, a separate number can keep your personal one private. See how to keep your personal number private on app sign-ups.
GetVerifyCode lists numbers in 190+ countries, and the live catalog covers 1,600+ services. Top up your wallet from $1. Each number is priced live per service and country. You see the quote before you confirm, and if no SMS arrives in about 20 minutes, the unused credit returns to your wallet. You can get started here or check pricing.
Some apps reject virtual numbers. Acceptance is decided by the app, not by us. Never use a temporary number for banking, payments, crypto or any account you need to keep.
Using a temporary number to protect your privacy, travel, or test your own app is generally lawful in many places, but laws differ by country and each app sets its own terms. Check both. Never use it for fraud, impersonation, or getting around a ban. More in are temporary phone numbers legal and our acceptable use policy.
Related guides
- Didn't get the verification code? 12 fixes
- What Is a Verification Code? SMS Codes Explained
- What does OTP mean?
About the author: Alex Carter is the editor at GetVerifyCode. Alex tests SMS verification routes across services and countries and writes plain-language guides on receiving OTP codes safely.
GetVerifyCode is not affiliated with the apps named in this article. Follow each app's terms and local law.
FAQ
FAQ
Usually someone keeps entering your number, a script is retrying a sign-in, or your number is still saved on someone's old account. If you have an account with that service, change the password and turn on a stronger second step. If you don't, contact the service and report the texts as junk.
Link is Stripe's saved-checkout service, and it texts a code when someone enters your number at a checkout that uses it. Repeated codes often mean someone is typing your number by mistake. Don't share the code. Our guide to Link verification code texts covers what to do.
The code itself can't hurt you. The risk is sharing it, because it can let someone finish a sign-in or take over a number. Don't send it to anyone, and check your Google Account's security page yourself. See why did I get a Google code I didn't request.
Don't reply with the code, and don't start a conversation with the sender. Reporting the text as junk or spam in your messages app is the safer choice. If the code names a bank or payment app, contact that company through its own app or website.
