I gave out a code, password, or card number

Passwords, PINs, and card numbers stop working once you change or cancel them. Social Security rarely issues a new number, so you freeze your credit instead.

If it’s happening now

They’re still on the phone or in the chat. Hang up or stop replying. Don’t read out another code, even if they say the first one didn’t work.

They said a code would cancel a charge or protect your account. No code does that. Whoever has it can sign in as you, reset your password, or approve a payment. Check the account yourself, or call the number on your card.

A code arrived that you didn’t ask for. Don’t share it or tap Approve. Someone may be trying to get into that account. Open it yourself, in its app or on a site you type in, and change the password.

They’re on your computer. Hold the power button until it shuts off. From another device, call your bank and change your passwords. I let someone control my computer.

What to say

• Someone got me to read them a code you texted me, and they may have my online banking password. Can you lock my online banking, check for anything pending or anyone newly added to send money to, and give me a case number?

• I typed my card number and the three digits on the back into a scam site. Can you close this card, send me a new one, and remove it from any Apple Pay or Google Pay I didn't set up?

• Someone used a code I was tricked into giving them to move money I didn't send. I'm reporting it as an unauthorized transfer under Regulation E.

• Someone got a code or PIN for my phone account. Can you change the PIN and lock my number so it can't be moved to another carrier or phone?

• Hey, it's me. Did you just ask me for a code on WhatsApp? I think someone's taken over your account.

If something already left your hands

Not sure which account a code was for? The text usually names the company.

A code, password, or PIN for your bank

Call the number on the back of your card. Ask them to lock online banking, remove devices you don’t recognize, confirm the phone number and email on file are yours, and look for transfers and anyone newly added to send money to. Get a case number. Gave them your card’s PIN? Ask for a new card and PIN. Then change your online banking password from a device the scammer never touched.

Call today. Federal rules limit what you can owe for transfers you didn’t make, and the limit is lowest if you report within two business days of finding out. Money that left without you sending it counts as an unauthorized transfer (Regulation E), even though you gave them the code. The CFPB names this exact case. Wires aren’t covered: ask for a recall on the same call, and file at ic3.gov at the same time. If you sent it yourself, the bank may call it authorized: I paid or sent money.

A card number and the three digits on the back

Call the number on the back of the card and ask for a new card. Gave them a texted code too? Say so. On fake toll and delivery pages, that code often adds your card to Apple Pay or Google Pay on the scammer’s phone. Ask the bank to remove your card from any phone or watch you didn’t add.

On a credit card, you aren’t responsible for charges you didn’t make when only the number was taken. Dispute them in writing within 60 days of the first statement that shows them. On a debit card, report fast. If you still have the card, you owe nothing for charges you report within 60 days of the statement. I paid with a credit or debit card.

A code for something else

Email, Apple, Google, or Microsoft. Follow the password steps below.

WhatsApp. Open WhatsApp, log back in with your number, and enter the 6-digit code it texts you. That logs everyone else out. Then turn on two-step verification (Settings > Account > Two-step verification), and warn your contacts by text or phone.

Google Voice. They used your code to link a Google Voice number to your phone, so they can scam other people without being traced. If you don’t use Google Voice, take your number back at voice.google.com/regain.

Your phone company, or a “transfer PIN.” Someone may be moving your number to their phone. Call your carrier from another phone, and ask them to change your account PIN and lock your number so it can’t be moved. My phone suddenly has no service.

Venmo, Cash App, or PayPal. Change your password in the app, and check your payments. I paid with Venmo, Cash App, PayPal, or Apple Cash.

A password

1. Change it from a device the scammer never touched, in the app or on a site you type in yourself.
2. In the account’s security settings, sign out devices you don’t recognize, and check that the recovery phone number and email are yours. On an email account, delete any rule that forwards your mail somewhere you don’t recognize.
3. Used that password anywhere else? Change it there too, starting with your email and your bank.
4. Add a second step to sign in. A passkey or an authenticator app is the goal. Text-message codes are better than nothing. A passkey can’t be read out to anyone.

Locked out: Someone got into my account.

Your Social Security number, Medicare number, or a photo of your ID

Freeze your credit at all three bureaus. It’s free, lasts until you lift it, and doesn’t affect your score.

Get an IRS Identity Protection PIN at irs.gov/ippin. It’s a six-digit number, new each year, that prevents anyone else from filing a tax return with your Social Security number. Can’t verify online? That page lists other ways. The IRS never asks for it.

Open a my Social Security account and check your work history. Earnings you don’t recognize mean someone may be working under your number. If you get benefits, ask Social Security (1-800-772-1213) for the Direct Deposit Fraud Prevention block. It stops anyone, you included, from changing your deposit account or address online or through a bank.

Freeze your file at ChexSystems too. Many banks check it before opening an account, so a freeze makes it harder to open one in your name.

Gave a photo of your driver’s license? Tell your state’s motor vehicle office. It may flag the license number.

Gave your Medicare number? Call Medicare (1-800-633-4227) and ask whether you need a new one. Check your Medicare statements for care you didn’t get. A call about Medicare or your health coverage.

If someone has already used your information (a new account, a loan, a tax return, benefits), report it at IdentityTheft.gov for a recovery plan. If not, you don’t need a report. Check your credit reports at AnnualCreditReport.com. It’s free every week.

Gave only your name, address, phone number, or email? There’s nothing to cancel. Expect calls that use them. Knowing your address doesn’t make a caller real.

After the calls

Save the texts and every case number (Save evidence without spiraling). Report it at ReportFraud.ftc.gov, and at ic3.gov if it happened online. Forward scam texts to 7726.

Anyone who offers to get money back for a fee, including someone who says they’re with the FBI, IC3, the FTC, or a law firm, is running a second scam. Someone offers to get my money back.

What it looks like

8:52 a.m. Your bank just texted you a sign-in code you didn't ask for. Then this text arrives, and you reply NO.

(614) 555-0179

Text Message
Today 8:52 AM

Fernmont Bank ALERT: A Zelle payment of $1,850.00 to ROBERT HAYES is pending. Did you authorize this? Reply YES or NO

NO

Thank you. To cancel this payment and secure your account, reply with the 6-digit code we just sent to your phone. For your protection, do not share this code with anyone else.

The code came from your bank's real number. What do you do?

• Reply with the code to cancel the payment
• Don't reply, and delete both texts
• Call the number on your card and tell them about the code

Show the answers

• Wrong move Reply with the code to cancel the payment Your bank sent that code because someone is signing in as you or resetting your password. A code doesn't cancel a payment. Whoever has it gets in.
• Okay Don't reply, and delete both texts They don't get the code. But someone got as far as your bank's sign-in, maybe with your password, and that's still open. Keep both texts. The bank may want them.
• Best move Call the number on your card and tell them about the code The bank can see the sign-in attempt and check whether anything is pending. Then change your online banking password, in the bank's app or on the site you type in yourself. A new password locks out whoever has the old one.

A code you didn't ask for may mean someone is trying to get into that account. Don't share it, and change that account's password.

Ten minutes later, WhatsApp on your phone says your number may be registered on another phone.

WhatsApp Linda

7:15 PM

Hi, sorry, I sent a 6-digit code to your phone by mistake. Can you send it to me? It's urgent

318-604

Thank you

WhatsApp just logged you out. What do you do first?

• Call Linda to find out what happened to her
• Leave it until someone can help you this weekend
• Verify your number in WhatsApp with the new code it texts you

Show the answers

• Okay Call Linda to find out what happened to her Worth doing. Someone took over her account first, and she may not know. But until you log back in, they can write to your groups and anyone who messages you, as you. Get it back, then call her.
• Wrong move Leave it until someone can help you this weekend Until you log back in, they can write to people as you, often asking for money.
• Best move Verify your number in WhatsApp with the new code it texts you WhatsApp says entering that 6-digit code logs out everyone else using your account. If it then asks for a two-step PIN you never set, they set it. You'll wait 7 days to get back in, but they're already logged out.

Type a code only into the app or site you opened yourself. Never read it to someone who contacted you. Once you're back in, warn your contacts by text or phone call, not on WhatsApp.

You just entered your card on a page a toll text sent you. Your phone buzzes with a code from your bank.

nytoll-balance.com/verify

Unpaid Toll Notice

Balance due: $6.95
Payment method: card ending 4471

Verify your payment

We sent a 6-digit code to your phone. Enter it below to finish.

Verification code

Submit

The page is waiting for the code your bank just texted. What do you do?

• Enter the code so the payment goes through
• Close the page and don't enter the code
• Close the page, then call the number on your card

Show the answers

• Wrong move Enter the code so the payment goes through On pages like this, the code your bank sends is the one that confirms adding your card to Apple Pay or Google Pay. Entering it puts your card in a wallet on a phone the scammers control.
• Okay Close the page and don't enter the code They don't get the code. But the page already has your card number, expiration date, and the three digits on the back, so the card still needs replacing.
• Best move Close the page, then call the number on your card The page already has your card. Ask the bank to close it, send a new one, and remove it from any Apple Pay or Google Pay you didn't set up.

A toll or delivery page that asks for the code your bank texted you is trying to add your card to a mobile wallet on a phone you don't own. Close it and call the number on your card.

What they’ll ask for

“I sent a code to your number by mistake. Can you send it to me?” From a friend’s account, this usually means someone has taken it over. The code is for your account. Call your friend.

“Before we meet, I need to make sure you’re real. I’m sending you a code.” On Marketplace or Craigslist, that’s usually a Google Voice code. Don’t read it out.

“Enter the code we just texted you to finish your payment.” On a toll or delivery page, that code often adds your card to Apple Pay or Google Pay on their phone. Close the page and call the number on your card.

“Tap Approve on the alert we just sent.” Same as reading out the code. Don’t approve it.

“Send your driver’s license and Social Security number for the paperwork.” Fake recruiters ask before telling you anything about the job. Don’t send them. A real employer asks after you’re hired.