Skip to content

ACTIVE CRISIS

I gave a scammer my OTP or 2FA code — what do I do now?

You're in the right place. This is a very common scam. Here's what to do in the next few minutes.

In an active crisis?

  • Call your bank
  • Call the platform (Amazon, PayPal, MobilePay, etc.)
  • Call local police

Step 1 — Change your password right now

Do this now: Go to the account the scammer asked you to verify and change your password immediately. Do this before anything else.

An OTP (one-time password) or 2FA code is a single-use code your account sends to confirm it's really you. When you gave that code to the scammer, they used it to log in to your account — or to confirm a transaction — in real time.

Important: The code has already been used. Changing your password now stops the scammer from getting back in with a new code. It does not undo what they already did — but it closes the door.

If you can, change the password from a different device — a phone you trust, or a different computer. Use a password you have never used before.

Step 2 — Check what the scammer accessed

Do this now: Log in to the account and check your recent activity. Look for logins from unfamiliar locations, any changes to your email address or phone number, and any transactions or transfers you did not make.

Most accounts show a "recent activity" or "login history" section in settings. Check it now.

Important: If the scammer changed your recovery email or phone number, change them back immediately. If you cannot get back in, use the account's official account-recovery process — not any number the scammer gave you.

If the account is linked to a bank, payment app, or credit card, check those accounts too. Look for any charges or transfers you did not authorize.

Step 3 — Call your bank if money moved

Do this now: If you see any transaction you did not make, call your bank immediately. Tell them: "I gave a scammer a verification code and I need to report unauthorized activity."

Banks have fraud teams who handle exactly this. The faster you call, the better your chances of stopping or reversing a transfer. Use the number on the back of your bank card — not a number from the internet or from the scammer.

Important: If the scammer used your OTP to authorize a payment app transfer (Venmo, Zelle, Cash App, PayPal), open the app and report the transaction as fraud immediately. Look for "Report a problem" in your transaction history.

Step 4 — Secure your other accounts

If you use the same password on other accounts, change those passwords now. Scammers often try the same credentials across email, banking, and shopping sites.

Do this now: Check your email account. If the scammer accessed your email, they can use it to reset passwords on every other account. Change your email password and check for any forwarding rules or filters the scammer may have added.

Once you have secured your accounts, set up 2FA again — but this time using an authenticator app (such as Google Authenticator or Microsoft Authenticator) rather than SMS codes. Authenticator apps are harder for scammers to intercept.

You're safer once you've done this: Password changed, recent activity checked, bank called if needed, other accounts secured. You have done the right things.

Step 5 — Report it

Report what happened to the authorities in your country. You do not need to have lost money to report — reporting helps authorities track scam patterns and warn others.

Also report it to the platform where the scammer contacted you — email provider, social media, or messaging app. This helps get the scammer's account removed.

What happens next

If you have changed your password, checked your account activity, and called your bank if money moved — you have taken the most important steps.

This is a very common scam. Real companies — banks, Amazon, PayPal, Apple, Google — will never call you and ask you to read out a verification code. If someone asks for a code you did not request, that is always a scam.

This is not your fault. These calls are designed to create panic and urgency so you act before you think. You are not alone.

Related situations

This page was last reviewed: June 26, 2026.
Crisis pages are drafted with AI assistance, then reviewed line-by-line by the editor, sourced against official reporting authorities, and tested for tone and clarity before publication.