A Verification Code You Did Not Request

A verification code you did not ask for means someone typed your phone number into a form. Usually that person made a typo or is the previous owner of your number. Sometimes it is someone trying to sign in to your account or register your number on a messaging app. The code itself is harmless while it stays on your phone. The danger starts if you share it, so never read it out, forward it or type it into a link someone sends you.

Why did a code arrive when you asked for nothing?

The message names the service that sent it, and that is the first clue.

What the text says	Likely cause	What to do
A sign-up code from a service you have never used	Someone mistyped their own number, or tested a form with a random one	Ignore it
A login or password-reset code from a service you do use	Someone is trying to get into your account, often with a leaked password	Secure the account now
A WhatsApp, Telegram or Signal registration code	Someone is trying to register your number on their phone	Do not share it, turn on the app’s PIN
Codes from many unrelated services within minutes	An SMS bombing tool is flooding your number	Ignore, report, wait it out
A code followed by a message asking you to forward it	A scam in progress	Do not reply, block the sender

There is one more harmless case. If your number was recently assigned to you, the previous owner’s accounts may still point at it. Their codes and alerts will keep arriving until those services are updated. The post on changing your phone number explains why that happens.

When does an unrequested code mean someone is trying your account?

When it is a login, password-reset or two-factor code from a service where you have an account. A service sends those only after someone enters your number or email on its sign-in page, and many services send the code only after the correct password. A two-factor code you did not trigger usually means your password is already known, often from a breach of another site where you reused it.

Do these from your own device, opening the app or typing the site’s address yourself. Do not use links from the text.

1. Change the password, and make it unique to that service.
2. Sign out every other session from the account’s security page.
3. Turn on two-factor authentication with an authenticator app if it is still on SMS. The post on two-factor authentication without a phone number explains the options.
4. Check the account’s recovery email and phone, and remove anything you did not add.
5. Check the email account tied to it in the same way, since a takeover often starts there.

Why would a scammer want you to forward the code?

Because the code is the last thing they need. These scams arrive as a text or a message from a “friend” whose account was already taken over.

• “I sent my code to you by mistake, can you send it back?” The code was for your own account. Someone is registering your WhatsApp or Telegram on their phone, and the code would hand it to them. Once they hold it, they message your contacts with the same trick.
• “Read me the code so I know you are a real seller.” On marketplaces, a buyer asks for a code before paying. The code is usually a Google Voice verification, and reading it out links a new Google Voice number to your phone number, which the scammer then uses for other scams. The US Federal Trade Commission has warned about this exact pattern.
• “This is your bank, please confirm the code we just sent.” The caller has started a login or a payment on your account and needs the code to finish it. Banks do not call to ask for a one-time code.

Legitimate services never ask you to share a verification code with another person. Many, WhatsApp among them, say so in the message itself.

What do you do about a WhatsApp, Telegram or Signal code?

A registration code for a messaging app means someone typed your number on a new phone. If they get the code, they take over the account on that phone and your phone is signed out.

Turn on the app’s own lock so the code alone is not enough.

• WhatsApp: Settings, Account, Two-step verification. It asks for a six-digit PIN whenever your number is registered again.
• Telegram: Settings, Privacy and Security, Two-Step Verification, which adds a password after the code.
• Signal: Settings, Account, Registration Lock, which requires your Signal PIN to register the number again.

Repeated codes from the same app usually stop once the person gives up. How each app checks your number is covered in how WhatsApp, Telegram and Signal verify your number.

What if codes keep arriving from many services?

A burst of codes from unrelated services within a few minutes is usually an SMS bombing tool. These tools submit one number to many sign-up forms at once to harass its owner. Nobody gets into your accounts this way, because the codes go only to you.

Do not reply to any of them. In the US and the UK you can forward spam texts to 7726, which reports them to your carrier. If it continues for days, ask your carrier whether it can filter the traffic. Services that sent the codes usually rate-limit the number after a few attempts, so the flood tends to stop on its own.

How do you get fewer stray codes in future?

Fewer places holding your number means fewer forms where someone can type it, and less of it in breach data. Keep your personal number for the accounts that need it, such as your bank, your main email and your messaging apps. For a one-off sign-up that only checks a number once, a rented number answers the check, and the account’s recovery then runs through your email.

Common questions

Can someone hack my account just by having my phone number?

Not from the number alone. They also need the code, and on most services a password too.

Should I reply STOP to an unrequested code?

There is no need. STOP opts you out of that one sender’s texts but does not stop someone typing your number into a form, and replying to an unknown sender confirms your number is active. Ignore it, or report it as spam if it looks like a scam.

Will the code work for anyone if I do nothing?

It expires, usually within a few minutes, and it is useless to anyone who cannot see it.