Got a Verification Code You Didn't Ask For? Here's What It Means

Short answer: don't share it, and don't panic. A code you didn't ask for usually means someone typed your number by mistake, or someone is trying to sign in to your account. Either way, the code protects you only if it stays with you.

What a surprise code really means

A verification code is sent when someone tries to sign in, sign up, reset a password, or link an account using your phone number. If you didn't do any of those things, there are three common explanations.

1. A simple typo. Someone else entered your number by mistake. This is common and harmless if you just ignore the code.
2. Someone has your password. If your password leaked in a data breach or was stolen on a fake login page, a criminal may be trying to sign in. The code is the only thing stopping them.
3. A scam is about to start. The criminal triggers the code on purpose, then calls or texts you pretending to be the company, a friend, or someone who "sent it by mistake", and asks you to read it out.

Got a code from Plaid?

Plaid is a service that many banking, payment, and budgeting apps use to connect to your bank account. Plaid's own help page says an unexpected Plaid code is most often caused by another person mistyping their phone number. But it can also mean someone is trying to use your banking information without permission. Plaid says its support team will never ask you to share your one-time code by phone, text, or email.

If you keep getting Plaid codes, check your bank account for anything unusual, and contact Plaid through the support assistant on its official help center.

What to do right now

1. Don't share the code with anyone, for any reason, and don't reply to the message.
2. Ignore anyone who contacts you about it. A call or text asking for "the code we just sent" is a scam, every time.
3. Go to the account yourself. Open the official app, or type the website address yourself. Don't use any link in the text.
4. Change your password to a new one you don't use anywhere else, especially if the code was for your email, bank, or WhatsApp.
5. Sign out of all other devices and check for changes you didn't make, such as a new recovery email, a new phone number, or email forwarding rules.
6. Turn on two-step verification with an authenticator app where you can. It is harder to steal than a text message code.

If the codes keep coming

Repeated codes for the same account usually mean someone is trying again and again. Change that password straight away, and check whether your email address has appeared in a known data breach. If you reused the same password on other accounts, change those too.

If you already shared the code

1. Act fast. Go to the account and change your password immediately, then sign out of all other devices.
2. If it was a bank or payment code, call your bank on the number on the back of your card and tell them what happened.
3. If it was WhatsApp or another messaging app, warn your contacts, because criminals often use a stolen account to ask friends and family for money.

The rule is simple: a code you didn't ask for is a warning, not a request. Keep it to yourself, and check your account on your own terms.

Sources: Plaid: What do I do if I've received a one-time passcode from Plaid that I did not request? · Guardio: Got a verification code text you didn't request?