A Login Code You Didn't Request

Protect yourself

Never disclose one-time security codes. Check your account directly for suspicious activity.

How it works

You receive a verification code you didn't request. Shortly afterward, someone calls or texts asking you to share it.

An unrequested code means someone already has your password and is trying to log in right now. Sharing the code finishes their login. Change the password instead.

Red flags

A code you didn't ask for, then a message explaining why you should share it
Someone claiming they "accidentally" sent their code to your number
Codes from several services arriving in a short period

If it already happened

If you already tapped the link and entered card or login details: call your bank from the number on your card, and change the password anywhere you used it. If you replied, expect more messages; block the number and delete the thread. Forward scam texts to 7726 (SPAM) so your carrier can act on them.

Where OpenEFA fits

Texts never pass through a mail gateway. Treat every unexpected payment link on your phone the way you'd treat one in email: open the official app instead.

Scam Watch No. 24 · EFA Security · efasecurity.com/scam-watch/ · Print this page and post it where your team will see it.

No. 23: Sorry, Is This the Wrong Number? Back to the full list

Part of the OpenEFA MailGuard Scam Watch series. Published October 21, 2026 by the EFA Security team. Share it freely; a link back is appreciated.

At a glance

Type: Account Security
Channel: Text Message Scams (Smishing)
They want: Your login and MFA code
One rule: An unrequested code means someone has your password. Change it.

Post it in the breakroom

This page prints as a one-sheet poster with no menus or sidebars.

Print this alert

Get these by email

One short alert when something needs your attention. No marketing, one-click unsubscribe.

All 24 alerts

Phone, email and text message scams, each on one page.

Scam Watch index