“Send me the verification code I just sent you”: harmless question or data grab?

Reading the line

The code you just received was triggered by someone typing your phone number into a service. That might be Google Voice, where your number is used to create a calling account the scammer then uses to run other scams under your identity. It might be a messaging app, letting them take over your chats and message your contacts as you. It might be your email, your bank, or a marketplace account, where the code is the last thing standing between them and your login. The pretext of "verifying you're real" is a clever inversion — it presents the theft as a safety measure, and because caution is a reasonable thing to want from a stranger online, it can sound almost thoughtful. It isn't. Verification never works by asking the other person to read out a secret sent only to them. If you take one rule from this entire library, take this one: codes are never shared, not with a partner, not with support, not with anyone.

What it does for the sender

One text can be worth more than months of relationship building, which is why this request often arrives early and from accounts that have invested very little in you. A Google Voice number registered to your phone gives an operation a US number that looks legitimate, passes basic checks on other platforms, and points back at you if anything is investigated. Account takeovers go further: control of your email or messaging app lets them reset other passwords, read your recovery messages, and approach your friends and family with a request for money that appears to come from you. The request is engineered to feel trivial. It's six digits, it takes two seconds, refusing feels paranoid, and if you're already invested in the conversation, the social cost of saying no feels higher than the technical risk of saying yes. Add urgency — a phone that just broke, a setup that's half-finished — and there's no room left to think. That absence of thinking time is the entire point.

Where the conversation tends to go

1. 1A new account created in your name, used to scam other people
2. 2Loss of access to your own messaging, email or social accounts
3. 3Password resets on connected services, including financial ones
4. 4Your friends and family contacted from your account with urgent money requests
5. 5Further requests for codes, screenshots or account details once the first one works

When there's nothing wrong with it

Being fair, ordinary people do occasionally ask about codes without meaning harm — a partner setting up a shared streaming account, a family member adding you to a plan, or someone confused about a two-factor prompt they triggered on their own account. Even then, the right handling is the same: codes stay with the person they were sent to, and shared accounts get set up together, in person, on the owner's own device. Genuine confusion also looks different from the script. A real person who accidentally sent a code to your number will apologise and fix it themselves rather than press you to read the digits out. Nobody who understands what they're asking for will keep asking once you've said no, and someone you're dating online has no legitimate need for a code in the first place.

Replies that keep you safe

Already replied, paid or shared something?

Move quickly. Change the passwords on your email, messaging and financial accounts, starting with email because it controls the others, and sign out all other sessions. Turn on two-factor authentication using an authenticator app rather than SMS, and set a PIN or two-step verification in WhatsApp or Telegram. Check Google Voice at voice.google.com to see whether a number was claimed with your phone and reclaim it, and review connected devices and forwarding rules in your email settings. Warn your contacts that messages from you may not be from you. Report to ic3.gov and reportfraud.ftc.gov, tell your mobile carrier and ask about a port-out or SIM-swap lock, and screenshot everything first. This request is designed to be answered in seconds without thinking, so responding fast now is the right correction.

Suss explains common patterns in online dating messages. It is not a background check, not legal or financial advice, and a single line is never proof that someone is lying. Use it as one signal among several.