Shared an OTP or Verification Code? What to Do Next

8 min read ScamSense Team Updated October 23, 2026

You gave a code to someone and a moment later it felt wrong. What matters now is speed and one question: what was that code for? A code that confirms a payment, one that logs into your email, and one that registers your number on a messaging app can each do very different damage, and the fix for each is different.

Quick answer: Stop all contact with the person, then identify what the code was for. If it confirmed a bank or card payment, call your bank or card issuer immediately using the number on your card or in the official app. If it was a login or account code, secure that account and sign out every other session. If it was a messaging-app registration code, re-register your number to take the account back. Do not share any further code, and do not pay anyone who offers to “reverse” it.

The First 10 Minutes

End the conversation. Hang up or stop replying. Do not argue, threaten, or ask the person to “cancel” anything — they will use the time, and a frightened reply tells them you may send more.
Work out what the code was for. Look at the original text, email or app notification. It usually says what it authorises: a payment, a login, a number registration, a password reset. Keep that message; you will need it.
Contact the real institution, not the caller. Use the number printed on your card, the official app, or the website you type in yourself. Never use a number the caller or a message gave you.
Lock down the affected account. Change the password from a device you trust, sign out of all other sessions, and re-check your recovery email and phone number. The hacked-account guide below walks through this in order.
Write down the timeline. Note the time you shared the code, the caller’s number or username, and any transaction alerts. This shortens every later conversation with your bank or the authorities.

What the Code Could Have Done, by Type

Scammers rarely ask for a code at random. They trigger a real action — a login, a payment, a registration — at the moment they call or message you, then ask you to read out the code the real service just sent you. The code is the last step they cannot do without you.

A bank, card or wallet payment code

This is the most time-sensitive case. The code may have approved a transfer or card payment. Check your recent transactions in the official app, and call the bank to report an unauthorised transaction, ask them to block cards or online banking, and ask what dispute or recall process applies. Card payments can often be disputed through the issuer; bank transfers can sometimes be recalled, but the chances fall quickly with time. No one can promise a refund, so ask what the bank can actually do and what they need from you.

A login or two-factor code (email, social media, shopping, cloud storage)

If the scammer already had your password — for example from a data breach or a phishing page — the code gave them the final key. Assume the account is taken or about to be. Change the password, sign out of all devices, review recovery options, and check for forwarding rules or new devices. Start with email: whoever controls it can reset almost everything else. See Account Hacked? What to Do, Step by Step.

A messaging-app registration code (WhatsApp, Telegram and similar)

Scammers who get this code can register your phone number on their own device, logging you out. They then message your contacts pretending to be you and asking for money. To take the account back, reinstall the app and register your number again; the new registration signs the attacker out. Turn on the app’s two-step verification PIN so a code alone is not enough next time, and tell close contacts not to send money or codes to anyone messaging from your old number until you confirm by phone.

A SIM, number-port or mobile-account code

Codes that authorise moving your number to another SIM or provider can let an attacker receive your future SMS codes. If your phone suddenly loses signal, or your carrier sends a message about a SIM change you did not request, contact your carrier at once using its official channel and ask for a port-out lock or SIM PIN if offered. Then secure the accounts that send codes by SMS, banking first.

A marketplace or classifieds “verification” code

A buyer says they have “sent payment” and need a code to release it. Receiving money never requires you to read a code or PIN to the sender. If you shared one, check which account it belonged to and treat it as a login or payment code from above.

Illustrative scenario — fictional, names and details are invented

Maya lists a sofa for sale. A “buyer” messages that he has paid through the platform’s secure payment and that she must read him the six-digit code she just received so the money can be released.

Maya reads it out. Seconds later her phone shows a payment alert for an amount leaving her account. She hangs up on the next call, opens her bank’s official app, and calls the number inside it to report the transaction as unauthorised. She changes her banking password and keeps the original text with the code.

What mattered: she recognised the code was authorising a payment out, acted within minutes through an official channel, and did not engage the “buyer” again. Whether the bank can recover money depends on the bank, the payment method and how fast it was reported.

If Money Has Already Left Your Account

Report to the bank or card issuer first. Say it plainly: “I shared a one-time code with a scammer and there is an unauthorised transaction.” Ask for a reference number and ask them to block the card or online access.
Report to the national authority. In India, the National Cyber Crime Reporting Portal is cybercrime.gov.in and the helpline is 1930. In the United States, report to the FTC at reportfraud.ftc.gov and, for internet-enabled crime, to the FBI’s IC3 at ic3.gov. Elsewhere, search for your country’s official cybercrime or fraud reporting service from a government (.gov or equivalent) page.
Keep your evidence intact. Do not delete the messages, call logs or transaction alerts. Our guide to preserving evidence after an online scam explains what to save and how.
Expect a second approach. People who have been scammed are often contacted by a “recovery agent” offering to get the money back for a fee. That is a separate scam — read The Scam After the Scam.

Report quickly, even if you feel embarrassed. Banks and regulators often have reporting windows, and earlier reports leave more options open. Check the terms of your account and your country’s rules; do not assume a deadline has passed.

How the Request Usually Sounds

Real services send you a code so that you can type it into a screen you opened. The scam is any conversation that turns that around:

“We sent a code by mistake — please read it back to us.”
“I need the code to verify your identity before the refund / prize / delivery.”
“Your account will be blocked unless you confirm the code now.”
“Read me the code so I can send your payment.”
A caller who knows your name and some details and already seems to be “fixing” a problem you never reported.

No genuine bank employee, courier, marketplace or support agent needs you to read out a one-time code. More background is in the Banking Scam Guide and on how scammers create urgency.

Make the Next Attempt Harder

Where possible, move important accounts from SMS codes to an authenticator app or a hardware or passkey option.
Add a SIM PIN or port-out lock with your carrier if it offers one.
Turn on transaction alerts and set sensible transfer limits in your banking app.
Use a different password for your email than for anything else, and enable two-factor authentication on it.
Pause with the 10-second rule whenever anyone creates urgency around a code, link or payment.

If a later message or call feels off, you can paste the text or a screenshot into ScamSense for a risk assessment before you reply. It is an extra check, not a guarantee, and it does not replace calling your bank.

Key Takeaways

Identify what the code was for — payment, login, messaging registration or SIM — because the fix depends on it.
Contact your bank or the service through official channels, never through the caller.
Secure your email and any account that uses the same password.
Report to your national authority and keep the evidence.
Ignore anyone who contacts you afterwards offering to “reverse” the loss for a fee.

Not sure whether a message is asking for a code you shouldn’t share?

Paste the message or a screenshot into ScamSense for a risk assessment before you reply. It is an extra check, not a guarantee — your bank remains the place to report a payment.

Start 3-Day Free Trial

Frequently Asked Questions

Can someone misuse my OTP if they do not know my password or PIN?

Yes, depending on what they have. A code can be the last missing step for a login, a payment, or a number registration, and scammers often start the action themselves just before asking you for the code. Treat any shared code as serious until you have checked the account it belonged to.

I shared the OTP but not my card details. Am I safe?

Not necessarily. The scammer may already hold your card number or login from a breach or phishing page and need only the code. Check your transactions and call your bank using an official number.

Do OTPs expire quickly enough to protect me?

Many expire within minutes, but scammers use the code immediately while you are on the phone. Expiry does not help once you have read it out, so act on the assumption that it was used.

What if I shared a WhatsApp or Telegram verification code?

Re-register your number in the app on your phone to sign the attacker out, switch on two-step verification, and warn close contacts not to send money or codes to messages from your number until you confirm by phone.

Will my bank refund the money?

It depends on the bank, the payment method, local rules and how quickly you report. Some losses are reimbursed, many are not, and no one can promise an outcome in advance. Report immediately and ask the bank what applies to your case.

Should I change my phone number or SIM?

Usually not. Contact your carrier if you see signs of a SIM swap, such as sudden loss of signal or unexpected SIM-change messages, and ask about a port-out lock or SIM PIN.

Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.