A code can feel harmless because it expires quickly and is not your password. That can make an unexpected request for one especially persuasive. A caller might say the code proves your identity, stops a transaction, confirms a refund, or shows that you are a real person. Before responding, separate the caller’s explanation from the message that actually delivered the code.
The FTC warns against sharing verification codes with unexpected contacts. Its published example concerns Google Voice; it is not evidence that a payroll-card provider uses that same process. The transferable lesson is that an unfamiliar person may be trying to complete their own action using a code sent to you.
Read the purpose without following the caller
If you receive a code, notice the service named and any stated purpose. Do not read the code aloud, paste it into a chat, or approve a prompt just because someone tells you their job title. A code you did not request can be a reason to check the relevant service independently. It is not a request you must satisfy to stop the phone from ringing.
In an original fictional example, a worker posts an item for sale. A buyer asks for a code to prove the listing is genuine. Nothing about selling a chair should require helping a stranger create or access a separate account. The inconsistency is easier to spot when the claimed purpose and the actual service are written as two different sentences.
An existing conversation can still change direction
A code request may arrive after several ordinary messages. The person may have answered questions, used your first name, or shown knowledge of a workplace. That conversational history can make refusal feel impolite. You can stop when the request changes. Agreeing to discuss a concern does not commit you to disclosing access information or approving a transaction.
A practice response is: “I will use the service’s own process.” Then leave the interaction and navigate independently. Do not ask the caller to send a second code as proof. That would keep the test inside a process they may be controlling. Do not paste codes into this publication’s contact email or search box; this site has no account-verification function.
If you already shared a code
Treat the event as an exposure even if you have not seen a missing balance. Contact the affected service through a trusted route promptly and explain which service issued the code and what the caller claimed. If a paycard, PIN, credentials or funds may be affected, contact the verified card provider as well. Follow the service’s account-recovery instructions rather than instructions from the unexpected contact.
Do not assume that changing one password ends every consequence, or that a temporary code means no harm could occur. Conversely, do not conclude that every account you own has been compromised. The useful next step is a service-specific check based on what you disclosed. Keep a short private note afterward, without recording the secret itself. Read sort what was shared for that distinction and notice the pressure for a rehearsal before the next unexpected request.
Sources and reading boundaries
Sources checked October 7, 2026. This is a review date, not a policy effective date or an account test.
- FTC: Verification-code scam warning: Do not disclose a verification code to an unexpected contact. Google Voice example is not represented as a Corpay feature. Review basis: Official source text reviewed through search-index retrieval; direct navigation may be unavailable.
- CFPB: Lost or stolen prepaid card, PIN or unauthorized charges: Prompt provider reporting; payroll cards have federal error-resolution protections. Particular liability, procedure and outcome are not determined here. Review basis: Official source text reviewed through search-index retrieval; direct navigation may be unavailable.
- FTC: What To Do if You Were Scammed: Prompt payment-provider contact and recovery requests, account and identity recovery routes. No promise of reimbursement. Review basis: Official source text reviewed through search-index retrieval; direct navigation may be unavailable.