How to Spot Fake OTP Emails

One-time codes are everywhere now — and so are fake ones designed to panic you into handing over access.

The classic scam

You get a "verification code" you didn't request, followed by a message (or call) asking you to read it back "to confirm your identity." Sharing it hands an attacker your account.

Rules that keep you safe

• Never share a code with anyone, ever. Legitimate companies don't ask.
• If you didn't trigger a code, ignore it — and change your password if codes keep arriving.
• Check the sender domain and that the code's context matches an action you just took.

Testing tip

When evaluating a new service, receive its codes in a disposable inbox. Good inboxes auto-detect and highlight the code so you can copy it without exposing your real address.