If you're asking "why am I getting verification codes I didn't request", the answer is usually one of these: someone typed your number by mistake, someone is trying to sign in to one of your accounts, a scammer wants you to read the code back to them, or your number used to belong to someone else. A code on its own can't hurt you. What matters is that you never share it, and that you check the account it's for if it's a service you actually use.

The one rule that covers every case

Never give a verification code to anyone, whether they text, call or message you, and whatever reason they give. A real company won't ask you for it. Keeping the code to yourself stops most of the scenarios below on its own.

Why am I getting verification codes I didn't request? Five common causes

1. A stranger made a typo

Someone signing up for a service mistyped their own number and entered yours. One or two codes from the same service, then silence, is the classic pattern. Nothing has happened to your accounts, and you can ignore it.

2. Someone is trying to get into your account

If the code comes from a service you do use, someone may be entering your phone number or email on its login or "forgot password" page. They might already have your password and be stuck at the second step. The code arriving means the security is working: as long as it stays with you, they don't get in. Still, treat it as a warning and follow the steps further down.

3. A scammer wants you to read the code back

This is the one to watch for. A scammer starts a sign-in or sets up a service using your number, which sends a genuine code to your phone. Then they contact you with a story: they're a buyer for something you listed, a friend whose code "went to you by mistake", or support staff who need to "confirm your identity". Pass the code on and you've handed them an account, or let them register a service in your name.

4. Your number used to be someone else's

Carriers reassign numbers that have been disconnected for a while. If your number is fairly new to you, the previous owner's accounts may still be linked to it, so their logins and password resets now come to you. These codes name services you've never used, and they often repeat.

5. Bots are working through lists of numbers

Automated scripts sometimes enter long lists of phone numbers into sign-up forms, either to find out which numbers are active or to generate paid SMS traffic, a fraud known as SMS pumping. You get a stray code from a service you've never heard of. It's annoying but not aimed at you personally.

Real code or phishing text?

Some "verification" texts aren't codes at all, but phishing messages dressed up as one. Warning signs: