Someone called asking for your security code. Don't read it.
- A call or automated message claims your bank, Amazon, or Google detected suspicious activity on your account.
- They ask you to "verify your identity" by reading back the security code you just received by text.
- That code is the scammer's key to your account - they triggered the code themselves by attempting to log in.
- No legitimate company ever calls you and asks for a code they just sent you. Ever.
This is a scam. A verification code you receive is for you to enter somewhere - not to read aloud to a caller. The moment someone asks for that code, the call is fraudulent regardless of what number it came from or what name it claimed. The FBI documented over 5,100 complaints and $262 million in losses from this pattern in the first months of 2025 alone.2
Does this sound familiar?
Below are reconstructed examples. (Illustrations, not real screenshots. Numbers and names are fictional.)
The same script runs across dozens of platforms: banks, Amazon, Google, PayPal, crypto exchanges, social media. The pretext changes; the code request never does.
How it works
This attack is sometimes called an OTP bot scam or real-time phishing. Unlike SIM swap fraud - where the scammer intercepts your codes at the carrier level - this one works by talking you into handing the code over yourself. (Screens shown below are illustrations.)
Red flags to catch it early
None of these alone is proof. Several together means hang up immediately.
This is the clearest signal. The scammer triggered the code by attempting to log in. The call and the code arriving together is not a coincidence - it is the mechanism.
Verification codes are for you to enter on a website or app - not to recite to a caller. Any request to read a code aloud is the scam, regardless of what else was said on the call.
"We need the code right now to block the transfer." This is pressure to prevent you from pausing or hanging up to verify the call independently. Real fraud teams do not have a countdown.
"This transaction will complete in 90 seconds if we can't verify you."
Phone number spoofing is trivial and cheap. A call displaying your bank's genuine fraud line number is not proof the call is from your bank. When in doubt, hang up and call back on the number on the back of your card.
Many attacks use fully automated bots - no human ever speaks. The bot places the call, delivers the script, and captures whatever code you say or keypress. The professional sound of an automated system is not evidence of legitimacy.
Most legitimate platforms include a line in their code messages saying "never share this code" or "we will never ask for this." If a caller is asking for exactly the thing the text told you not to share, the text itself is telling you the caller is a scammer.
Already read the code to someone?
Need the steps by payment method? See what to do if you've been scammed.
Act in the next five minutes
Speed matters more here than in most scams. The account takeover is in progress or already complete.
Where to report it
For the full country guide - agencies, phone numbers, and what happens after you report - see how to report a scam by country.
How big is this problem?
The verification code attack is not new, but automated OTP bots have made it vastly more scalable. Operations that once required a human caller for every victim now run entirely on software, cycling through thousands of targets simultaneously.
The verification code attack sits in a family of account takeover methods that also includes SIM swap fraud - where the attacker intercepts your codes at the carrier level without ever speaking to you - and account verification phishing, where a fake login link collects your credentials directly. The OTP bot variant is mechanically distinct from both: your phone stays on your network, no link is involved, and the code you receive is real. The only human error in the chain is reading the code aloud.
Switching from SMS-based two-factor authentication to an authenticator app eliminates the attack surface entirely - codes generated by apps cannot be extracted over the phone because the scammer cannot trigger a phone call that intercepts them. CISA specifically recommends authenticator apps over SMS for this reason.4
Frequently asked questions
- Would my real bank ever ask me to read back a code?
- No. The FBI and FTC both state explicitly that legitimate companies never contact you to ask for a one-time passcode or verification code. The code is sent to confirm that YOU are the one trying to log in or make a change - not to verify your identity to someone who called you. Any caller asking for a code you just received is a scammer, regardless of what number they appear to call from.
- I already read the code - what do I do now?
- Act immediately. Go to the real account (bank, email, Amazon, etc.) and change your password now. Check for any transactions, password changes, or new devices added in the last hour. Call your bank's real fraud line if the account involves money. If you cannot get back in, contact the company's official customer support to report the account takeover.
- How did the scammer know to call me right when I got the code?
- They triggered the code themselves. The scammer already had your username and password (from a data breach or phishing attack) and tried to log in to your real account. The platform sent you a verification code to confirm the login - and then the scammer calls to trick you into reading it back. Your phone receiving the code is the signal that they are already at your login screen.
- Which accounts are most at risk?
- Any account protected by SMS-based two-factor authentication: bank accounts, email, Amazon, social media, crypto exchanges, and PayPal. Bank accounts and crypto wallets are the most targeted because the financial loss is immediate. Email accounts are also high-value because they can be used to reset passwords on every other account.
- How do I protect myself going forward?
- Use an authenticator app instead of SMS for two-factor authentication wherever possible. Authenticator apps generate codes that cannot be intercepted by a phone call. Also use a unique password for each account so that a breach of one does not give access to others. If you receive an unexpected verification code you did not request, someone already has your password - change it immediately without reading the code to anyone.
- Federal Trade Commission, "What's a verification code and why would someone ask me for it?", March 2024. FTC consumer alert specifically addressing OTP extraction fraud. Also source of $3B imposter scam loss figure for 2025.
- FBI / IC3, Public Service Announcement on Account Takeover Fraud via Impersonation of Financial Institution Support, 2025. Source of 5,100+ complaint and $262M+ loss figures for this specific pattern.
- IC3 / European law enforcement, JokerOTP operation documentation, 2025. 28,000 attack figure and multi-country scope. Reported by multiple security researchers and law enforcement press releases; cited here as an illustrative documented case rather than an exact total.
- CISA, More Than a Password - Multi-Factor Authentication. Source of CISA recommendation to use phishing-resistant MFA (authenticator apps) over SMS-based OTP.
We document recurring online scam patterns using primary sources - government agencies, law enforcement, and security researchers. We do not accuse named businesses, and ads on this page do not influence our reporting. Read about how we research or who we are.