ScamSmarts

Requests for sign-in or recovery codes

Someone posing as a bank, carrier, vendor or IT asks you to read out, reply with or type in a one-time code or recovery code.

How to spot it

  • Anyone asking you to read, reply with or forward a sign-in code
  • A request for recovery codes, which only you should ever use
  • A reason that sounds helpful: verifying, stopping a charge, fixing your account

What to do

Never share a code or recovery code. Hang up or stop replying, then contact the company through its app, its own site or the number you already have.

What the real thing looks like

  • A code that arrives right after you asked for one, with a note to enter it only on the real site
  • A setup page on the company's own domain asking you to save recovery codes for yourself

Try an example

A practice example with fictional companies. Answer it, then see the tells.

Is this chat message a scam or legit?

Conversation: Direct message
From: Orbit Cloud SupportExternal

Hi, we are moving Lakeside Family Clinic to the new storage plan today. You will get a verification code by text in a moment.

From: Orbit Cloud SupportExternal

Please paste the code here so we can finish the move for your account. It only takes a minute.

Your answer
How sure are you?

Sure and right: +15. Sure and wrong: -5. Calling a legitimate item a scam counts as a miss.

Test yourself on eight more

The free quiz mixes scams with legitimate messages, like real life. No sign-up.

Take the free quizTrain your whole team free

Sources