Getting a verification code you did not request usually means someone is trying to log into, reset, or create an account using your phone number or email. If it is a login code, it often means they already have or are guessing your password, and your two-factor step is doing its job by blocking them. It can also be a scam trying to trick you into reading out the code, or simply another person mistyping your number. Never share the code with anyone.
Why this happens
- Someone has your password and triggered the second login step, so the code is stopping them.
- Someone is attempting a password reset on one of your accounts.
- A scammer wants you to read them the code, often while pretending to be support.
- Another user typed your number or email by mistake when signing up.
- Automated bots are testing leaked username and password lists.
Is this normal?
A single stray code now and then is often just a typo by someone else. Repeated or frequent codes are a sign that someone is actively targeting one of your accounts.
Does it cause any problems?
A code you simply ignore is harmless on its own; it actually means your account held. The danger is if you share the code, or if your password is already known, in which case you should change it right away.
How to fix or check it
- Never share the code with anyone, including callers claiming to be support or your bank.
- Do not approve any login or sign-in prompt you did not start yourself.
- Identify which service sent it; the message names the account.
- Change that account's password to a strong, unique one immediately.
- Make sure two-factor authentication is on, and prefer an authenticator app or a passkey over SMS codes.
- Review the account's recent login or security activity and sign out other sessions.
- If codes arrive in a flood, that is a fatigue attack and confirms your password is likely leaked, so change it now.
- Check whether your email appears in known breaches and update any reused passwords.
Frequently asked questions
Does getting a code mean I am hacked?
No. It means someone reached the code step. They cannot get into your account unless they also obtain the code, which is why you should never share it.
Should I click links in the code message?
No. Real verification texts do not need you to click anything. Treat any link in them as possible phishing.
Why do I keep getting them?
Repeated codes usually mean your password has leaked and someone is trying to use it. Change that password and consider switching to app-based codes or a passkey.