Verification code text you didn't request: what it means

Why you got a code you never asked for

There are three real causes, and official help pages and the FTC agree on them. Microsoft’s support page says an unrequested code could mean “someone is trying to access your account,” “someone accidentally entered the wrong phone/email when trying to sign in,” or a code you asked for long ago arrived late. WhatsApp’s help center gives the same two main reasons: people mistype their own number, or someone is trying to take over your account.

The FTC warns often about a third. Someone triggers the code on purpose because they plan to contact you and talk you into handing it over.

A mistake. Someone with a number one digit off from yours signs up for an app. Or your number used to belong to someone else, and their accounts still point to it. WhatsApp’s help page even has a note for the previous owner of a phone number. Nothing about your own accounts is at risk.

Someone trying your account. They have your email or number, and sometimes your password from an old data breach. The code is the second lock, and it did its job. Apple lists “a two-factor authentication code… that you didn’t request” as one of its signs of a compromised Apple Account.

A setup for a scam. The code arrives, then a call or text follows. For example: “I sent you a code by mistake, can you send it back?” or “This is your bank’s fraud team, read me the code to verify.” The FTC is blunt about this: “Anyone who asks you for your account verification code is a scammer.”

Where the code came from, and what to do about it

What the code is for matters more than who sent it. A code you’d need after typing a password means more than one you’d get just from typing an email.

The code came from	What it most likely means	What to do
An app or site you don’t use	A typo, or a previous owner of your number	Ignore and delete it
Google (sign-in or 2-Step Verification code)	A sign-in, recovery or new-account attempt using your number	Run Security Checkup; change the password if you see a sign-in you don’t know
Apple (two-factor code)	Someone has your password, or entered your number as their own	Check your device list, change your password
Microsoft (“single-use code”)	Someone typed your email, or tried your password	Review recent activity at account.microsoft.com
WhatsApp (registration code)	Someone entered your number, by mistake or to take over	Never share it; turn on two-step verification
Google Voice	Someone wants a Voice number linked to your phone	Don’t share it; see our Google Voice guide
Your bank or card	A login attempt, or a scam call about to happen	Call the number on your card, not one in a message

The Microsoft row trips people up. In a May 2026 Microsoft Q&A thread, a volunteer told a worried user to check the account’s Recent activity. An unsuccessful sign-in for a wrong password doesn’t generate a code. One labeled “request denied” means the password was entered correctly, so change it right away. If neither shows up, someone has probably listed your email or number as their own security info by mistake.

Google’s own text page says much less. If you got a code by text you didn’t request, “you can disregard and delete” it, don’t share it with anyone, and take a Security Checkup.

Source: What’s a verification code and why would someone ask me for it?, FTC; Troubleshoot Microsoft verification code issues, Microsoft, checked October 2026. Note: a diagram of steps, not data.

Is someone in my account? How to check in five minutes

A code by itself proves nothing got through. To be sure, look at the account’s own record of devices and sign-ins. Go there by typing the address or opening the app yourself, never through a link in the text.

Apple. On your iPhone, open Settings > [your name] and scroll down to the device list. Tap any device you don’t recognize to see its details and remove it. Apple’s own advice for a compromised account is to change the password, remove unknown devices at account.apple.com, and confirm with your carrier that nobody has set up SMS forwarding on your number.

Google. Sign in at myaccount.google.com and run the Security Checkup, which Google recommends on its help page about unrequested text codes. Google says it gives personalized recommendations for keeping the account safe.

Microsoft. Sign in at account.microsoft.com, open Security, and look at the recent sign-in activity, as the Q&A volunteer described above. Real Microsoft code emails come from an @accountprotection.microsoft.com address, according to Microsoft’s help page.

WhatsApp. As long as WhatsApp still works on your phone, the attempt failed. WhatsApp says someone trying to verify your number “can’t complete the verification process” without the SMS code.

Your bank. Open the bank’s app or call the number on the back of your card. The FTC says never to use a number the caller or text gave you.

If any of these show a device or sign-in you don’t recognize, change the password first. Then sign out of other sessions and check the recovery phone and email haven’t been changed.

“I sent you a code by mistake”: the scam that follows

The dangerous moment isn’t the code arriving. It’s the message after it. Scammers trigger a real code from a real company, so the text looks perfectly legitimate, then they ask for it.

The stories vary. For example, a buyer on Facebook Marketplace wants to “verify you’re real” before buying your couch: that’s the Google Voice version the FTC described in October 2021. A friend’s hacked WhatsApp account says a code landed on your phone by accident. A caller claims to be your bank’s fraud team and needs the code to “secure” your account.

Each one is the same trick. The FTC compares your password and code to a doorknob lock and a deadbolt: a scammer needs both keys, and the code is the one only you can give them.

If you already gave a code away, act on that account now:

Google Voice: follow our guide to taking back a Google Voice number after sharing the code.
WhatsApp: re-register WhatsApp with your number. WhatsApp says that once you register your number again with the SMS code, anyone else using your account is logged out.
Apple, Google, Microsoft or your bank: change the password, check the devices list, and call the bank’s real number if money could be involved.

If you also tapped a link in a text, read what happens if you click a link in a scam text for the next checks.

How to make the codes stop

You can’t stop strangers typing your number, so the codes may keep coming. What you can do is make them useless and less frequent.

Move your important accounts off text codes. The FTC says text codes beat nothing, but an authenticator app or security key is safer, because a SIM swap can redirect your texts. Passkeys go further: there’s no code to steal. Our explainer on what happens to passkeys if you lose your phone covers the recovery side. Microsoft also suggests going passwordless on its accounts, which it says helps stop codes you didn’t request.

For WhatsApp, turn on two-step verification under Settings > Account > Two-step verification. Then anyone who gets your SMS code still needs your two-step verification PIN, which WhatsApp is now upgrading to a password. WhatsApp says never to share the registration code or that PIN.

If codes from one service never stop and nothing shows in your account, your number may be on someone else’s account by mistake. The Microsoft Q&A volunteer suggested a test: switch your own account to an authenticator app. If texts keep coming, they’re for someone else.

What not to do

Don’t reply to the text, not even STOP or “wrong number.” Don’t click links or call numbers in it. Don’t forward the code to anyone, including someone who says they’re from the company.

Do forward scam texts to 7726 (SPAM), which the FTC says helps carriers block them. And report anyone who asked for your code at ReportFraud.ftc.gov.

Scams that begin with a text are getting costlier. In its April 2025 data spotlight, the FTC said people reported $470 million in losses to text scams in 2024, more than five times the 2020 figure. The share of text-scam reports that involved losing money has also risen.

Source: Top text scams of 2024, FTC Data Spotlight, April 14, 2025, checked October 2026. Note: covers all text scams reported to the FTC’s Consumer Sentinel Network, not only code scams.

What to do next

Don’t reply to the text or share the code, and delete it if it’s from an app you don’t use.
If it’s a login code for an account you use, open that account yourself and check its devices and recent activity.
Change the password on that account if anything looks wrong, or if the code needed a password to be sent.
Turn on an authenticator app, passkey or WhatsApp two-step verification for your email, Apple or Google account, and bank.
Forward scam texts to 7726 and report anyone who asked for your code at ReportFraud.ftc.gov.

Got a verification code text you didn’t request? What it means