That Verification Request May Be the Scam

Key Takeaways

• Never share a one-time verification code with someone who contacts you.
• Don’t approve an unexpected login or authentication request.
• Treat repeated verification prompts as a possible warning that someone has your password.
• Change compromised passwords promptly and avoid reusing them across accounts.

Main Article

Multi-factor authentication and one-time verification codes add an important layer of protection to online accounts. But scammers are increasingly trying to turn those security measures against consumers by convincing them to approve a login attempt or share a code they didn’t request.

A scam may begin with a phone call or message from someone claiming to represent a financial institution or another company you trust. The person may say they’re investigating suspicious activity and ask you to read back a code sent to your phone. In reality, that code may be the final piece the scammer needs to access your account.

You may also receive repeated approval requests through an authentication app. Don’t assume you should approve one just to make the notifications stop. If you didn’t initiate the login, deny the request and go directly to the company’s legitimate app or website to secure the account.

Strong passwords and multi-factor authentication remain valuable defenses, but they work best when you recognize that the verification step belongs only to you. Never provide a security code to an unexpected caller, texter or email sender, and don’t approve a login you didn’t initiate. Those few seconds of caution can prevent someone else from getting access to your account.