DateableWhy you never read a text message code to a match
A six-digit code from a text usually unlocks your email, bank or phone. If a match asks for it, they are not who they say they are.
A match asks you for the six-digit code you just received by text: "I need it to confirm you're real." That code does not verify you. It unlocks your email, your bank account or your phone. If you read it to them, they use it to lock you out and take control of your accounts.
What those codes unlock
When you sign up for a new email or try to log in from a new device, or when you forget your password, a text message code arrives. It is a one-time password (OTP) or a multi-factor authentication (MFA) code. It proves to the service that you own that phone number. So if someone asks for it, they are trying to prove they own your phone to your email, your bank or your mobile provider.
How scammers use the code
A scammer with your email address and the code you read to them can reset your email password. Once they are in your email, they can reset your bank password, your social media, even your dating app account. In a matter of minutes, they lock you out and lock themselves in.
They can also use the code to port your mobile number to a device they control. Porting means moving your phone number from your carrier to theirs. After that, every code sent to your number lands on their phone instead of yours. Your bank, your email and your phone company all think they are you, because they trust the phone number linked to your account.
[1] This gives them full control. They can change recovery emails and phone numbers so you cannot get back in. They can access your photos, your private messages, your financial information. The damage spreads quickly.
The request and how to reply
A genuine person who wants to date you does not need a code to prove you are real. You are real when you meet them in person, or when you video call and match the photos you posted. A code asked for by text is the pattern scammers follow, so the request itself is a warning sign.
I don't share codes, sorry. If you need proof I'm real, let's video call or meet up.
If they push back or make an excuse not to video call or meet, that tells you what you need to know. They are not who they claimed to be. Do not send the code to convince them. Every real match respects this boundary.
Other warning signs before the code request
Scammers often ask for codes quickly, before you get to know them. But other signs usually appear first. They say they love you or care about you without ever meeting you in person. They always have an excuse not to video call or meet: they work abroad, they are on a military base, their phone is broken, there is a family emergency. They ask you personal questions but reveal nothing about themselves. If you search their profile name online or do a reverse image search on their photos, nothing matches or the photos belong to someone else.
Watch for these signs early. They are more reliable than waiting for a code request. [[getcybersafe-catfish]]
If you already shared the code
If you realised too late that you read the code to a scammer, or if they have already taken control of an account, act now. The sooner you move, the less damage they can do.
- Change your passwords, starting with your email. Your email is the master key: scammers use it to reset every other password. Use a strong password you have never used before, and do not reuse passwords across sites.
- Call your bank straight away. Tell them you shared a verification code with a scammer. Ask them to watch your account for unauthorised transfers, to reverse any fraud that has happened, and to place a fraud hold if needed.
- Call your phone provider. Tell them about the code and ask them to lock your account so your number cannot be ported to another carrier without speaking to you in person.
- Check your email settings for any changes you did not make. Look for new recovery email addresses, new recovery phone numbers, or forwarding rules that send your emails somewhere else. Delete anything that is not yours.
- Turn on multi-factor authentication (MFA) on all important accounts: email, bank, social media, dating apps. Use an authenticator app or security key instead of text messages if you can, since text messages can be intercepted.
- Contact IDCARE for help. [2] They advise people affected by scams and identity theft. In Australia and New Zealand, call 1800 595 160 (Monday to Friday, 7am-7pm AEST). From overseas, call +61 7 3555 5900.
Make codes harder to steal
Multi-factor authentication (MFA) or two-factor authentication (2FA) sends you a code only when you try to log in, not when a stranger asks. If you already turned it on, a scammer with your password still cannot get into your accounts without that code.
Set it up on your email first. Do it on your bank account and your phone provider next. When a code arrives, it is a sign someone (maybe you, maybe someone else) just tried to log in. Never share it, even if the person asking sounds urgent or upset.
Watch for other code requests
Scammers also ask for codes when they pretend to be your bank or phone company in a text or an email. A real bank or phone company will never ask you for a code in a message. If you see a text claiming to be from your bank and asking you to reply with a code, do not reply. Call your bank directly on the number on the back of your card.
[[getcybersafe-catfish] warns that scammers ask specific personal details to break into your accounts: birthdays, pet names, even the answers to security questions. Give those to no one you have not met in person, no matter how much they claim to care about you.
Sources
- Scamwatch (ACCC) (2026). Account or identity takeover scams.
- IDCARE (2026). IDCARE.
