What is a one-time passcode scam?

A one-time passcode scam tricks you into sharing a security code that may approve a sign-in, payment or account change. A criminal can claim it was sent by mistake or is needed to stop fraud. Read what the code authorises and never share it with an unexpected caller. 123

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. A criminal starts a sign-in or account action involving your details. 123
  2. You receive a code and a request to share it. 123
  3. The criminal uses the code to continue the action they started. 123

Real UK example

BBC reporting on Derbyshire Police in January 2025 described students being asked for WhatsApp codes by someone posing as a lecturer. The stated reason was joining a group call.

The codes were actually for account verification. This example shows why the message explaining a code matters more than the caller’s story. 3

Warning signs

  • A contact says they sent a code to you by accident. 123
  • Someone asks you to read a code out to stop fraud. 123
  • The code describes an action you did not start. 123
  • A message claims sharing a code is necessary to join a call. 123

What to do now

  1. Do not send the code or approve an action you did not start. 123
  2. Open the genuine service yourself and check the account. 123
  3. If you shared a code, contact the provider and follow its recovery process. Tell your bank if money is involved. 1234567

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 678
  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 79
  • If someone is in danger, call 999. 9

How to protect yourself

  • Read the purpose shown in verification messages. 123
  • Use two-step verification and keep recovery details current. 12345
  • Check unusual requests from known contacts through a different channel. 123

Frequently asked questions

What does OTP mean?

One-time passcode or one-time password. It is a temporary code used as part of a security check. 1

Can someone I know ask for my WhatsApp code?

They can ask, but do not share it. A known contact’s account may have been taken over. Check through another route. 3

Does receiving a code mean my account was already hacked?

Not necessarily. In the reported WhatsApp scam, the code arrived during an attempted sign-in. Sharing it enabled the takeover. 3

Read the longer guide

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Top tips for staying secure online | Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  2. Which?, Deepfake phone calls: a quarter of scam calls in the UK are powered by AI - Which?. Accessed 7 November 2026 (Europe/London).
  3. BBC News, Derbyshire Police warning over WhatsApp account takeover scam - BBC News. Accessed 7 November 2026 (Europe/London).
  4. NCSC, Recovering a hacked account | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  5. ICO, 23andMe fined £2.31 million for failing to protect UK users’ genetic data | ICO. Accessed 7 November 2026 (Europe/London).
  6. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  7. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  8. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  9. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).