← Scam Defense: How to Keep Your Money
Lesson
Lesson 8. Text codes, push prompts, and what works without a code
Apply the one rule about codes, and understand that keeping a code to yourself no longer guarantees you're safe.
The code is yours, and only for your own action
The code is yours, and only for your own action
A code from a text and an approval in the app work the same way: they come when you've started something yourself — signed in, paid, approved a transfer. Hence the rule, and there's only one.
You give a code only to someone who gets it from you in person: the courier handing over your order, or the clerk at the pickup point. Over the phone, you never give a code to anyone. Neither your bank nor Login.gov nor Social Security asks for codes.
A text with a code isn't dangerous in itself: a code is useless until you say it or enter it. The danger isn't the code, it's whoever asks you to read it out. That request is where you pull the emergency brake: the conversation is over.
Let's take it apart: a caller says a code is about to arrive — read it out, or the request can't be canceled. The code doesn't come; he blames a glitch and rushes you. Neither outcome is a sign: “no code” doesn't prove it's a scam, and “the code came” doesn't prove the call is real. For you nothing changes: code or no code, you don't say it.
And an honest caveat: “I didn't give the code” no longer means “I'm safe.” Money leaves without a code too: if, at someone's request, you installed an app that gives access to your phone; held your card to the phone and entered your PIN; or simply sent the money yourself. To the bank, all of this looks like your own actions.
Lesson notes
The code is yours, and only for your own action
A code from a text and an approval in the app work the same way: they come when you've started something yourself — signed in, paid, approved a transfer. Hence the rule, and there's only one.
You give a code only to someone who gets it from you in person: the courier handing over your order, or the clerk at the pickup point. Over the phone, you never give a code to anyone. Neither your bank nor Login.gov nor Social Security asks for codes.
A text with a code isn't dangerous in itself: a code is useless until you say it or enter it. The danger isn't the code, it's whoever asks you to read it out. That request is where you pull the emergency brake: the conversation is over.
Let's take it apart: a caller says a code is about to arrive — read it out, or the request can't be canceled. The code doesn't come; he blames a glitch and rushes you. Neither outcome is a sign: “no code” doesn't prove it's a scam, and “the code came” doesn't prove the call is real. For you nothing changes: code or no code, you don't say it.
And an honest caveat: “I didn't give the code” no longer means “I'm safe.” Money leaves without a code too: if, at someone's request, you installed an app that gives access to your phone; held your card to the phone and entered your PIN; or simply sent the money yourself. To the bank, all of this looks like your own actions.