code check

A pile of codes you never asked for? Breathe.

It looks scary, and it usually isn't as bad as it looks. Here's the short version of what's going on, and what to do about it.

The 60-second version

Those codes are usually bots. They type your email or phone number into sign-up and "forgot password" boxes on lots of sites at once. Each site sends the code to you, not to them.

A code on its own doesn't mean anyone is in your accounts. It's a locked door that's asking, "Is this you?" The danger starts only if someone talks you into handing the code over.

The real risk is the noise. A flood can bury the one message that matters, like a bank alert or a "your password was changed" email. So take ten minutes to check, then lock things down.

A code is a key. Never read one out, text it back, or type it in because someone asked.Real companies don't ask. If a "bank agent" or "support" calls or texts you first and wants a code, that's the scam.

Why is this happening to me?

Your email and phone number are easy to find. They leak from old data breaches, get sold on marketing lists, and show up on people-search sites. Nothing you did wrong. It's a numbers game bots play against millions of people.

What the message says tells you how worried to be.

  • Low worry

    "Verify your email," "Reset your password," "Confirm your account"

    Probably a bot using your info on a sign-up or reset form. The code comes to you, so they're stuck. Ignore the messages and don't tap any links.

  • Act today

    "Your login code" or "Sign-in attempt" for an account you really have

    Someone may already know your password for that site, maybe from a leak or because it's reused, and just hit the second-step wall. The code stopped them this time. Change that password today.

  • Act now

    Codes plus a bank alert, a charge, or "your password was changed"

    The flood may be cover noise for something real. Skip ahead to the checklist and the card steps.

Quick test: search your email for password changed, new sign-in, new device, and order confirmed. If nothing odd shows up, you're probably in the low-worry group.

Did anything actually happen?

If any of these are true, you're past annoying and into act-now territory:

  • Charges or orders you didn't make
  • Emails saying your password, email address, or phone number was changed
  • You're locked out of an account you didn't touch
  • Your phone suddenly shows "No service" or "SOS only" (someone may have moved your number to their phone, called a SIM swap)
  • Friends say they're getting strange messages from you

If you spot any of those, call your bank and your phone carrier now, then work through the checklist. If you don't, it's the annoying kind. The checklist still makes you much harder to target next time.

Your checklist

Do the first group now. The rest can wait until later today or this week. Your progress saves on this device only.

0 of 16 done

Right now

About 5 minutes

Later today

About 15 minutes

This week

Set it up once, then forget it

If someone already used your card

Card numbers leak separately from passwords, through store breaches, skimmers, and fake checkout pages. A card getting used doesn't always mean a password was cracked. The fix is the same either way.

  1. Call the number on the back of your card. Not a number from a text or email.
  2. Say "unauthorized transactions." Ask them to cancel the card, issue a new number, and open a dispute.
  3. Move fast. In the US, federal rules protect you better the sooner you report, and banks usually refund verified fraud.
  4. Call the store and tell them the order is fraud so it doesn't get shipped or picked up.
  5. Update autopay and subscriptions with the new card number.
  6. Report it at ReportFraud.ftc.gov. If someone used your personal info to open accounts, also use IdentityTheft.gov.

Things people worry about

"Getting codes means I got hacked."
Not by itself. The codes come to you, so whoever triggered them is stuck unless you hand one over.
"I should reply STOP or call the number in the message."
Skip it. Replying or calling back can walk you straight into a scam.
"I must have done something dumb."
You didn't. Leaked emails and phone numbers are everywhere, and bots work through them all day.
"Text codes are the strongest protection."
They're a solid start. Passkeys and authenticator apps are stronger because they're much harder to trick out of you.

Words people throw around

One-time code (OTP)
The short number a site sends to confirm it's you. Good for a few minutes.
Two-step verification (2FA, MFA)
Your password plus a second proof, like a code or a passkey.
Passkey
A login that lives on your phone or computer and unlocks with your face, fingerprint, or PIN. Nothing to type, nothing to steal.
Phishing
A fake message or website built to trick you into giving up a password or code.
Credential stuffing
Criminals trying a leaked email and password on hundreds of other sites, hoping you reused it.
SIM swap
Someone convinces your carrier to move your phone number to a SIM they control, so your texts go to them.