Staying safe
A code received by text message is never given away
What you will be able to do In 5 minutes, you will know how to read a code received by text message, and who you will never give it to.
Many services add a second check when you sign in: after your password, they send a six-digit code to your phone. This code is called a one-time code, because it only works once and is only valid for a few minutes. Its role is simple: to prove that it is really you, and only you. That is also why it has become the thing scammers ask for most often. We will learn to read it, then to give it to no one, on a screen we have drawn. Nothing here is real, so nothing can happen to you.
Simulated screen
I practice
This screen was drawn by us. Nothing is sent, nothing is installed, and no real brand is shown.
The situationA six-digit code arrives on your phone, and you did not ask for anything.
The interactive exercise needs JavaScript. The written step by step, just below, says exactly the same thing.
The written step by step
The same steps, in words, to read or print. This sheet works even without the exercise.
What the code confirms
Your turn Read the whole message. Tap the line that says what this code is going to confirm.
The line "It confirms signing in to your account from a new device" says exactly what the code authorizes. We read it before typing.
Why you get rushed
Your turn Another line explains why you will always be rushed for this code. Tap it.
The line "This code is valid for 5 minutes" explains the rush: after that, the code is worthless, even to a scammer.
A code you did not ask for
Your turn It is 22:47, and you have not touched anything. Tap the line that says what someone is trying to do.
The line "It confirms changing the password of your mailbox" says it all: someone is trying to get into this account, right now.
The right move, tonight
Your turn You did not ask for anything, and this code arrived. Tap what you do.
We leave the code untouched, open the service ourselves, and change the password of the targeted account without waiting.
We type it, we don't say it
Your turn Your code has arrived. Tap the place where it belongs.
The code is typed on the screen of the service you opened yourself, in the field provided. Never on a page reached through a link, never out loud.
The line that gives it all away
Your turn A voice introduces itself as your bank. Tap the line that proves the trap.
The line "give me the code, I'll block the payment" is impossible: a code confirms an action, it never blocks one.
The sheet to keep
- A code received by text message is a one-time code: it only works once, and it is only valid for a few minutes.
- The message always says what the code is going to confirm. You read that line before typing the digits.
- A code is used to confirm an action. It blocks nothing, it cancels nothing: asking for a code to block a payment is impossible.
- The code is typed on the screen of the service you opened yourself. It is never spoken, to anyone.
- A code that arrives when you asked for nothing means your password is already known to someone. You change that password right away.
- No advisor, no delivery driver, no support service ever needs your code. No one ever asks for it.
- In France, a fraudulent text message is reported for free by forwarding it to 33700, and cybermalveillance.gouv.fr offers a free online assessment.
The reflexes in this skill
A code I receive is never given to anyone
A one time code received by text message proves that it is really you. No advisor, no delivery driver, no service will ever ask for it. Giving it away opens the door in your place.
I stop before I click
Urgency is the sign of a trap. A message that counts down the hours is trying to stop you from thinking. Putting your phone down for two minutes costs nothing, and it is almost always enough.
I go through the official door
The address typed in by hand, the app installed from the official store, the phone number printed on the back of your card. Never the link someone hands you, even when it looks right.
No one serious ever rushes me
No threats, no countdown, no secret to keep. And asking for help is a reflex, not a failure: saying it out loud to someone makes most scams fall apart.
Two questions to check
Nothing is graded, and nothing is saved anywhere except in your own browser.
Someone on the phone asks you for the code received by text message, saying they will block a suspicious payment. What should you think?
See the answer
It is impossible: a code confirms a transaction, it never blocks one
A one-time code can only do one thing: authorize the action written in the message. It blocks nothing and cancels nothing. A request like this really means asking for permission to let the payment through.
A verification code arrives on your phone even though you asked for nothing. What do you do?
See the answer
I don't touch the code and I change the password of the account targeted
A code that arrives for no reason means someone already knows your password, or is trying to change it. The useful step is to leave the code aside and go change that password, by opening the service yourself.
I've done it
Check this box once you can do this skill on your own.
Your progress stays in your own browser.