MELKEM.

Never share your 6-digit code

Last checked

The rule

The rule

Never read out, forward or type in for someone else the 6-digit code a service sends you. That goes for a caller, a text, a chat message and a friend alike, however good the reason sounds.

That code is the last check between a stranger and your account. The Canadian Anti-Fraud Centre says it in one line: “Never share one-time passcodes (OTPs) with anyone – not even friends, family, or service providers”.

More guides: what two-factor authentication is, and why a code in an app beats a code by text message.

How

How the trick works

The Centre describes it in three sentences. “In many cases, perpetrators will initiate a login attempt using your phone number or email address. This triggers a legitimate one-time passcode to be sent to you.”

“The perpetrator will then contact you often impersonating a trusted organization, service provider, or even someone you know and request that you share the code.”

“Once the OTP is shared, fraudsters can take control of your account, lock you out, and use your identity to target your contacts or commit further fraud.”

That is why the text looks genuine: the code is real. The scammer is asking you to hand it over.

Asks

How scammers ask

  • A call from your “bank” or its “fraud team”. The Centre says suspects “will contact you claiming to be your financial institution and say that you must provide them with the code you get by text message or email in order to confirm your identity.”
  • A “support” agent, by phone, text or chat, who says they need the code to fix or check your account. The Centre’s list of who scammers pretend to be includes a “trusted organization” and a “service provider”.
  • A message from “someone you know”, which is another of the Centre’s examples, asking you to pass a code along.
  • A text saying a code was sent to you “by mistake” and asking you to forward it. The Centre lists this as a warning sign.
  • A code you did not ask for. The Centre’s warning signs include “You receive a one-time passcode you did not request”. That is the opening move of the trick above.

A test

A simple test

If someone who contacted you asks for a code, treat it as a scam. Hang up or stop replying, then open the real app or website yourself. You type a code into the service you are signing in to, never into a conversation.

The Centre’s page on impersonation says what it and the police will never do. One item: “ask for your banking information, passwords or verification codes”. And its page on bank investigator scams says: “Don’t share codes received via text message or email with anyone.”

Already shared

If you have already shared a code

The Centre’s page doesn’t set out steps for this case, so step 1 is our advice, not theirs.

  1. Open the real app yourself, or type the service’s address, and change your password.
  2. Look at your account’s sign-in activity and linked devices. The Centre advises you to “Review account security settings regularly, including linked devices and login activity”.
  3. Report it. The Centre says: “Anyone who suspects they have been the target of cybercrime or fraud should report it to their local police.” It also points to its Report Cybercrime and Fraud website “to report online or by phone at 1-888-495-8501”.
  4. Forward the suspicious text to 7726. The Canadian Centre for Cyber Security says: “Forward the suspicious SMS to 7726 (SPAM)”.

If the scammer has locked you out, see our guide on what to do if you lose your phone.

Sources

Sources

Canadian Anti-Fraud Centre: Securing your online accounts – protect your one-time passcodes, Bank investigator and Canadian Anti-Fraud Centre Impersonation.

Canadian Centre for Cyber Security: Smishing: Protect yourself from SMS attacks (ITSAP.00.103).

Ask MELKEM