Got a verification code text you didn't ask for? What it means and what to do

What an unrequested code means

Codes like this are 2-step verification. Stop! Think Fraud explains that the service sends you a PIN or code, which you then type in to prove it's really you. So someone who has your number, or even your password, still needs the code that was sent to your phone.

WhatsApp says it tells you when someone tries to register an account with your phone number. A WhatsApp code you didn't ask for is a sign that someone tried to set up WhatsApp with your number on their phone.

The one rule: never pass a code on

Not by text, not on a call, not to someone who says they work for the company, and not to a friend. WhatsApp says never to share your registration code, not even with friends or family. Apple says never to share your Apple Account password or verification codes with anyone, and that it never asks for them to provide support. The NCSC says your bank will never ask you to supply personal information.

The WhatsApp "I sent my code to you by mistake" scam

Kingston council describes how criminals use a WhatsApp account they have already taken over. They message that person's contacts, pretending to be them, and say a six-digit code was sent to the contact by mistake, or could not be received, so could they have it. The code is really the contact's own WhatsApp code. Sending it hands over their account, which is then used to ask more friends for money or for their codes.

Already shared a code? Get your WhatsApp back

WhatsApp says that changing your password won't remove someone from your account; re-registering with the 6-digit code sent to your number will. It also says that someone who re-registers your account on a new phone can't read your past chats, which stay on your device.

Other accounts: when codes keep coming

Repeated codes for an email, shopping or social media account can mean someone has your password and is stuck at the code step. Stop! Think Fraud's steps after a hack apply:

1. Go to the account provider's own help pages, typed into your browser yourself, and follow its recovery process.
2. Change the password, and the password of every other account that uses the same one.
3. Log out of the account on all your apps and devices.
4. Turn on 2-step verification if it isn't on already.

Apple Account codes, or prompts asking you to tap Accept: see what Apple says it never asks.

Report it

• A text that looks like a code message but asks you to tap a link or call a number is a scam text: forward it to 7726. The NCSC's advice is to contact the company through the details on its official website, never the ones in the message.
• If money was taken, call your bank, then report it to Report Fraud (0300 123 2040), or to Police Scotland on 101.
• If friends got money requests from your hijacked account, the pattern is the "Hi Mum, new number" scam: the check is always a call to a number you already have.

Not sure about a message? Paste it into the scam text checker. If you already tapped a link, see what to do after clicking a scam link.

Sources

• WhatsApp, recover a compromised account: WhatsApp Help Center, 'How to recover a compromised account': "You should never share your registration code with others, not even friends or family." Short quote; the rest is summarised in our own words. — https://faq.whatsapp.com/1131652977717250, read on 2026-10-02
• Kingston council, WhatsApp account compromise: Royal Borough of Kingston upon Thames, 'WhatsApp Account Compromise' advice leaflet (March 2025), summarised in our own words: criminals message the contacts of an account they have already taken over, pretend to be its owner, say a six-digit code was sent to the contact by mistake or could not be received, and ask for it; the code is the contact's own WhatsApp code, so passing it on hands over their account, which is then used to ask friends for money. — https://www.kingston.gov.uk/sites/default/files/2025-03/WhatsApp_Account_Compromise.pdf, read on 2026-10-02
• Stop! Think Fraud, if you've been hacked: Stop! Think Fraud (UK Government campaign), 'What to do if you've been hacked': "There are a number of signs that your email account, social media account or bank account might have been hacked. They include being unable to log into your accounts, changes to your security settings, messages sent from your account that you don’t recognise, attempted log-ins from unusual locations, and unauthorised payments from your online accounts. ... If you use the same password for any other accounts or sites, you will need to change all of them, as cyber criminals will try the same ‘hacked’ password across multiple accounts. ... Once you’ve changed your passwords, you need to make sure you log out of your accounts on all your apps and devices. ... 2SV (also known as two-factor authentication or 2FA) usually works by sending you a PIN or code, which you’ll then have to enter to prove that it’s really you." Contains public sector information licensed under the Open Government Licence v3.0. — https://stopthinkfraud.campaign.gov.uk/recovery-from-fraud/recovering-losses/what-to-do-if-youve-been-hacked/, read on 2026-10-02
• Apple, social engineering schemes (22 Jun 2026): Apple Support, 'Recognise and avoid social engineering schemes' (published 22 June 2026): "never share your Apple Account password or verification codes with anyone." Short quote; the rest is summarised in our own words. — https://support.apple.com/en-gb/102568, read on 2026-10-02
• NCSC, after your details are exposed: NCSC, 'Data breaches: guidance for individuals and families' (published 28 January 2021): "Be alert to suspicious messages (we've published guidance that can help you with this), which may be sent some time after the breach is made public. Remember, your bank (or any other official organisation) will never ask you to supply personal information." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/guidance/data-breaches, read on 2026-10-02
• NCSC, how to spot a scam: NCSC, 'How to spot a scam email, text message or call' (published 26 November 2021, reviewed 5 September 2022): "Urgency Are you told you have a limited time to respond (such as 'within 24 hours' or 'immediately')? Criminals often threaten you with fines or other negative consequences. ... If you have any doubts about a message, contact the organisation directly. Don’t use the numbers or address in the message – use the details from their official website." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams, read on 2026-10-02
• NCSC, forwarding to 7726: NCSC, Report a scam text: "Most phone providers are part of a scheme that allows customers to report suspicious text messages for free by forwarding it to 7726. If you forward a text to 7726, your provider can investigate the origin of the text and arrange to block or ban the sender, if it's found to be malicious." — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-09-29
• Report Fraud: Action Fraud / City of London Police press release, 4 Dec 2025, summarised in our own words: from 4 December 2025 fraud and cyber crime in England, Wales and Northern Ireland are reported to the new Report Fraud service, which replaced Action Fraud, at reportfraud.police.uk or on 0300 123 2040; people in Scotland keep calling Police Scotland on 101. — https://www.wired-gov.net/wg/news.nsf/articles/Report+Fraud+service+goes+live+04122025143000; https://www.reportfraud.police.uk/, read on 2026-09-29

Quotes from GOV.UK, legislation.gov.uk, mygov.scot, the NCSC, the ICO and NHS England are used under the Open Government Licence v3.0; material from Ofcom is Ofcom copyright. Other pages are summarised in our own words or quoted briefly, with a link. How we check.