Why Am I Getting Verification Codes I Didn't Request?

A text arrives with a six-digit code for an app you weren't using, or for one you've never signed up to. It's unsettling, and it's one of the most common phone-security questions people ask. The code itself can't hurt you; the danger is in what happens next, especially if someone contacts you asking for it. This guide explains the usual causes, how to tell harmless mix-ups from real attacks, and exactly what to do.

What are the common reasons for unrequested codes?

Most unrequested codes fall into one of a few categories. Which one applies usually depends on whether you have an account with that service.

What should I do right away?

Whatever the cause, the first rule is the same: don't share the code with anyone, and don't tap links in the message. A real code only needs to be typed into the app by the person who requested it.

• Don't reply to the text or forward the code.
• If you have an account with that service, open the app directly (not through a link) and change your password.
• Check the account for unfamiliar devices, sessions or recovery details and remove them.
• Turn on an authenticator app or passkey if the service supports it.
• If you don't have an account, you can usually ignore the message.

How do I spot a takeover attempt?

The biggest warning sign is contact after the code. A message from a friend asking you to forward a code they “sent by mistake,” a call from someone claiming to be support, or a text saying you'll lose your account unless you confirm the code are all classic tricks. The attacker has started a login on your account and needs the code you just received.

Some attacks also try to wear you down by sending many login prompts or codes. Repeated codes for an account you own mean someone knows your username or number, so change your password and add stronger two-factor authentication even if nothing else happened.

Why do I get codes for apps I've never used?

If your number was previously owned by someone else, their old accounts may still list it. Services send codes to the number on file, so you receive them. You can't access their account and shouldn't try. If the messages keep coming, contact the service to say the number is now yours, or simply ignore and filter them.

Mistyped numbers are another common cause. Someone signing up with a number that differs from yours by one digit will send you their code.

How can I reduce unwanted codes in the future?

Share your personal number with fewer services. The more places your number is listed, the more often it ends up in data leaks that attackers use. For sign-ups where you don't want to share it, a rented number can receive that one verification code instead; Noir SMS shows the code in your dashboard and refunds automatically if nothing arrives in 20 minutes. Use temporary numbers only for your own legitimate accounts, and remember they're single use, so add your own sign-in methods afterward.

For important accounts, move away from SMS codes entirely with an authenticator app or passkey, and ask your carrier about a port-out PIN or account lock to protect against SIM swaps.