Tried to get bank details or one-time codes

• 'To process the refund I need your card number and the code on the back.'
• 'We're sending you a code to confirm it's you. Read it to me.'
• A link to a login page that looks like your bank's.
• Requests for your SSN, date of birth, or mother's maiden name 'for the file'.

A one-time code is the key that proves it's you. Whoever has it can log in, reset your password, or move money, which is why banks say they'll never ask for it. The request works because it arrives inside a story you're already following, from someone who sounds official or friendly. Handing over details feels like cooperating, not like losing anything.

• Never read a code to anyone who calls or messages you, whatever the reason.
• If you gave a password, change it now everywhere it's reused and turn on two-step verification.
• If you shared card or bank details, call the number on the back of your card.
• Gave your SSN? Start a recovery plan at IdentityTheft.gov and consider a credit freeze.

More in the tips: Texts and calls.