What is a security code?
Definition
A security code is a short, usually one-time number that a company sends you to confirm you are really you when you log in, reset a password or approve a payment. Anyone who has it can act as you, so never share it.
- Category
- Security
- Also called
- verification code, one-time passcode, OTP, 2-step verification code
- Last updated
When you log in from a new device or reset a password, many sites text or email you a code and ask you to type it back. That proves you control the phone or inbox. This is the second step of two-factor authentication, and it's what the FTC calls a verification code.
The flip side is that the code is only as private as you keep it. The FTC says that if you share a verification code, a scammer can use it to prove they're you. Typical stories: a caller from your bank's "fraud department" asks you to read out the code you just received; a buyer on a selling site says they need a code to "confirm you're real"; a stranger asks for a Google Voice code so they can set up a number tied to your phone. In each case the scammer is the one who triggered the code, by trying to log in to your account.
Security code vs. card security code
The 3 or 4 digits printed on a payment card are also called a security code. They're a different thing: a fixed number on the card, not a code sent to you for one login. Both are meant to stay private.
A simple rule
You only ever type a code you asked for, on a site or app you opened yourself. No real bank, support team or buyer needs you to read one out loud or send it to them.
How to protect yourself
- 1
Never read a code to someone who contacted you
The FTC says not to share a verification code with someone you didn't contact first. Hang up and call the number on your card or the company's official site.
- 2
Treat unexpected codes as a warning
A code you didn't request usually means someone is trying to get into your account. Change that account's password and check its security settings.
- 3
Use stronger sign-in methods
A passkey or security key can't be read out to a scammer. See two-factor authentication.
- 4
Report it
Report scams to the FTC at ReportFraud.ftc.gov. If you already shared a code or moved money, tell your bank right away.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Why would someone ask me for my security code?
To log in as you. They start a login or password reset on your account, the company texts you a code, and they need you to hand it over.
I shared a code by mistake. What now?
Change the password on that account, review recent activity, and contact the company. If money was involved, tell your bank immediately.
Are texted codes safe to use?
They add protection over a password alone, but they can be phished. Treat them as secret and use a key or passkey where possible.
Sources
Something wrong or out of date? Tell us and we'll re-check it.