Facebook Messenger code scam: why a friend asks for your code
Quick answer
If a Facebook friend messages you asking for a code, they're probably not your friend. The FTC says anyone who asks for your verification code is a scammer. Don't send it, call your friend another way, report the message and block the sender.
- Comes by
- Social media, App
- Last updated
How it works
The message seems to come from a friend. It says something is wrong with their phone or account and asks you to accept, pass on or read out a code you just received. The FTC points out that your friend's account may have been hacked.
The code you receive is a verification code, the one a service sends to prove it's really you. A scammer who has your email or number triggers a code, then asks you to hand it over. With it they can take over your account or link your phone number to an account of their own.
A hacked account is then used to send the same message to your friends, which is how it spreads. Meta warns that even friends and family may unknowingly send you malicious links or attachments if their account has been compromised.
Red flags
- A friend asks you to send, read out or forward a code
- A reason that doesn't quite fit, such as their phone being broken
- A code you didn't ask for arrives right before the message
- The tone or wording doesn't sound like your friend
- Pressure to reply quickly
Example message
Hey, my phone is acting up and I can't log in. I'm about to send you a code, can you read it back to me? It's urgent, I need it now.
What to do
- 1
Don't send the code
Don't read it out, forward it or type it anywhere a message tells you to. The FTC says anyone who asks for it is a scammer.
- 2
Contact your friend another way
Call or text them on a number you already have to check whether their account was hacked.
- 3
Report and block
Report the message in Messenger and block the sender.
- 4
If you already shared a code
Change your password right away, turn on multi-factor authentication and review which devices are logged in to your account. If you can't log in, use Facebook's recovery page from a device you've used before.
- 5
Warn your friends
If your own account was used, tell your friends not to send any codes or money. See what to do after a data breach for securing your other accounts.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers pick friends of a hacked account because the message arrives from a name you trust. Your phone number and email, which they need to trigger the code, often come from data breaches and people-search sites. Serus finds the data brokers and people-search sites that list your name, address and phone number and sends the removal requests, and it alerts you when your details show up in a breach, so fewer scammers can reach you.
More Facebook scams
Frequently asked
Why would a friend need my verification code?
They wouldn't. The FTC says anyone who asks for your verification code is a scammer. The code proves your identity to a service, so sharing it hands over your account.
What if the message really came from my friend's account?
Their account may have been hacked. Call them to check, and tell them to secure the account.
I sent the code. What now?
Change your password, turn on multi-factor authentication and review your logged-in devices. Use Facebook's recovery page if you can't get in.
Is this a Facebook scam?
Scammers use Facebook Messenger to run it. Facebook publishes guidance on phishing and hacked accounts.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
