Account security · QUICK REFERENCE
Protecting one-time security codes
A one-time code is intended for the process that generated it. Do not give it to someone contacting you as support or asking to verify your identity in chat. If you receive an unexpected code, review the situation using the account provider's established security route.
A practical checklist
- Keep codes out of screenshots and messages.
- Check what the notification says the code authorises.
- Use the provider's official security guidance.
Putting it in context
Someone who knows your name or email address may still be impersonating support. Personal details do not make a request for a code legitimate.
Keep in mind
Never test a suspicious person's instructions to see whether they work.
References & further reading
The checklist and examples are original editorial guidance. External links provide background within their stated scope; they do not validate an individual operator or case.
- NCSC: staying secure onlineUnited Kingdom · account-security guidance
- NCSC: phishing guidanceUnited Kingdom · suspicious-message guidance
About this edition: how the content is made · corrections & limitations