Account Takeover and One-Time Code Fraud

Account takeover is the loss of control of an account to someone else. Criminals get in by reusing passwords exposed in data breaches, by guessing weak passwords, or by persuading you to read out a one-time code during a fake support call. Once inside, they change the password and recovery details, lock you out, and use the account to target your contacts. One-time codes are the last line of defence, which is why no genuine organisation will ever ask you to share one.

The takeover begins with a leaked password, a phishing page, or a phone call that asks for a code. Sometimes a criminal requests a password reset on your account, then calls you pretending to be support and asks you to confirm the code that was just sent to you.

The deception exploits helpfulness and authority. A caller who sounds like support and already knows your name makes sharing a code feel like a normal security step. The genuine code message often warns you not to share it, but the caller talks over that warning.

Your phone shows a code you did not ask for, followed by a call from someone claiming to be support. They say the code is needed to secure your account and ask you to read it out.

Examples include fake support calls that request a code, password reuse after a breach, and fake password-reset emails that lead to a look-alike login page.