A one-time code landing in your inbox or phone when you never asked for one is unsettling, but it does not automatically mean your account has been compromised. In most cases it signals that somebody entered your phone number, email address or password somewhere — either by accident or on purpose. The guidance issued by Google, Microsoft, Apple and WhatsApp converges on a single rule: never hand that code to anyone. What varies, and what this guide breaks down, is whether the incident also warrants an immediate password change.
- The code is the lock: Without the digits, an attacker cannot complete verification or take over your number, so control remains with you.
- Not all codes are equal: A registration or recovery code only requires knowing your phone number or email, while a login code implies someone already has your password.
- The real danger is the follow-up: Fraud typically begins when a caller or message arrives minutes later asking you to read the code aloud.
Three explanations, only one of them an attack
Microsoft’s documentation on verification code issues lists three plausible scenarios: someone is actively trying to access your account, someone mistyped your phone number or email during sign-in, or a code you requested earlier simply arrived late. WhatsApp’s guidance on unsolicited codes matches the first two — it usually happens when another person enters your number instead of their own, or when someone is attempting to seize your account.
The type of code is the clearest diagnostic signal. Registration and recovery codes can be triggered by anyone who knows your number or email address. WhatsApp sends one whenever somebody tries to register an account with your number, and Google dispatches a text to your recovery phone when someone attempts a password change. Neither implies the attacker knows your credentials.
Login codes are a different matter. Apple’s two-factor authentication documentation explains that signing in from a new device or browser requires both the password and a six-digit code. Microsoft describes “unusual activity” as a sign-in performed with the correct password but from an unrecognised location or device. In other words, a login code you did not request is evidence that the first barrier has already fallen.
Apple adds a useful caveat about the map that sometimes accompanies its notifications: the location is derived from the IP address and may reflect the network rather than the exact place, so it should not be treated as definitive.
What to do, service by service
The universal instruction is to share nothing — not by SMS, not by phone, and certainly not with anyone claiming to be technical support or a relative on a new number. Google states plainly that you can ignore and delete the message. Microsoft asks users not to respond to unsolicited codes. If an Apple notification asks you to approve a sign-in you are not performing, the sensible move is to decline it.
Beyond that, each platform offers its own review tools. Google recommends running its periodic Security Checkup, which produces personalised recommendations. Microsoft points users to the Recent activity page, which shows where and when the account has been used over the last 30 days; any Unusual activity section can be expanded entry by entry and marked as “That was me” or “That wasn’t me.” If unauthorised access is suspected, Microsoft advises changing the password from security settings, removing trusted devices, and optionally eliminating the password altogether in favour of the Microsoft Authenticator app, Windows Hello or a security key.
For WhatsApp, a registration code is harmless as long as it stays private. The company recommends enabling two-step verification and notes it lacks enough information to identify who triggered the attempt. Spain’s INCIBE has documented that the most common WhatsApp account theft method relies on tricking the victim into relaying precisely this SMS code.
A newer variant deserves attention. INCIBE warned in June 2026 about ghostpairing, in which a link such as “is this you in the photo?” leads to a page imitating a Meta service. The victim enters their number and ends up linking WhatsApp to the attacker’s device without losing access — which makes the intrusion considerably harder to notice. The defence is to review linked devices regularly and distrust any site requesting a phone number to “view” something.
When the code is the second piece of a scam
The dangerous moment is not receiving the code; it is receiving it and then, minutes later, getting a call, text or message asking for it. That sequence is the signature of fraud: the attacker has already triggered the send and only needs you to read out the digits. No legitimate company needs you to dictate a code it generated itself.
If you have already shared the code, act in this order: change the password of the affected account from a trusted device, close any sessions and linked devices you do not recognise, enable two-step verification, and warn your contacts if the account could be used to deceive them.
INCIBE handles queries through its Cybersecurity Help Line on 017.
The uncomfortable truth is that the security mechanism has itself become the fraudster’s tool. One-time codes were designed to prove identity, yet they travel over SMS, a channel that cannot distinguish between your bank and a stranger requesting a forward. The practical rule fits in a sentence: an unsolicited code is information, not an emergency. If it is a login code, change your password today. And if someone asks you for it, you already know who they are.