Facebook code scams: why you should never share that verification code
Quick answer
Anyone who asks you for a verification code is a scammer. The code is only for you to log in. Don't share it, don't click links in messages claiming to be from Facebook, and report the message.
- Comes by
- Social media, Text, Email
- Pretends to be
- Last updated
How it works
A verification code is the second lock on your account, next to your password. The FTC says scammers need both, so they try to trick you into handing over the code.
They pretend to be someone you trust and say there's a problem with your account or that someone is using your identity. On Facebook, that can be a message from a friend whose account was taken over, or an email or message that claims to be from Facebook. If you give them the code, they can log into your account.
Facebook's own help page warns about fake accounts and compromised accounts that try to defraud you or your friends of money, personal information or access to your account.
Red flags
- Anyone asking you to read out or send a verification code
- A message claiming to be from Facebook with a link to log in
- Urgent warnings that your account will be closed
- A friend's account asking for a code or money out of the blue
- A request to move the chat off Facebook
- Poor spelling and grammar
Example message
Hi, I accidentally put your number on my account. You'll get a code by text, can you send it to me? It's urgent, I'm locked out.
What to do
- 1
Don't share the code
Never give your verification code to someone else. If someone asks for it, stop replying, block them and report the account.
- 2
Don't click links in suspicious messages
Facebook says to check your Facebook settings to see whether an email really came from Facebook before clicking anything.
- 3
If you gave the code, secure your account
Use Facebook's page for regaining access to your account, change your password, turn on two-factor authentication and review which devices are logged in.
- 4
Warn your friends
If your account was taken over, tell your contacts not to send money or codes to anyone using it.
- 5
Check your other accounts
Change reused passwords, and call your bank on the number on your card if you shared financial details. Our guide on what to do after a data breach has the steps.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers who know your name, phone number or email can make a code request sound like a real account problem. That data is sold by data brokers, listed on people-search sites and leaked in breaches. Serus finds the data brokers that list you and removes you from them, and alerts you when your email shows up in a breach.
More Facebook scams
Frequently asked
Why would someone ask for my verification code?
The FTC says they need it, along with your password, to get into your account.
Is a message from a friend asking for a code safe?
No. Their account may have been taken over. Contact them another way and don't send the code.
How do I check if an email is really from Facebook?
Facebook says you can view recent emails it sent in your Facebook settings.
What do I do if I already gave the code?
Follow Facebook's steps to regain access, change your password, and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
