First, a quick reassurance: Your account itself may not be compromised yet, but if you give the verification code to the other party, your account is almost certainly fully stolen.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
A common malicious scam tactic called "verification code bombing" works like this: Scammers first use scripts to flood your phone with piles of crypto exchange verification code texts to confuse you. Then a person claiming to be "customer service" contacts you, saying "Our system detected abnormal login, please send me the verification code you received, I will help you block it." You are already overwhelmed by the non-stop texts, so you send them the code casually — and all assets in your account will be transferred away immediately.
Today we break this down fully: When a supposed customer service rep messages you out of the blue for a verification code, how to judge the situation and handle it correctly.
"Official customer service asking for a verification code" is inherently a false claim
Every crypto exchange's official help center clearly states: No official staff will ever actively ask you for your account password, SMS verification code, or Google 2FA code through any channel. Receiving a verification code only means that someone is currently trying to log in or operate your account, and your verification code is the last line of defense blocking this operation. Handing this line of defense directly to scammers is the same as mailing your house keys to a thief.
So no matter if it is via private message, phone call, or email, as long as you did not initiate an operation first, anyone who asks for a verification code for any reason should be treated directly as a scam. Your account has not been stolen yet, only because you have not given out the code.
3-step process when you receive a message asking for a verification code
Your goal is: block the attacker's attack chain, and confirm the status of your account.
Step 1: Do not reply to the message, and never give out the code
You don't need to do anything else. Don't reply, don't explain, don't even curse at them. Close the chat window directly. Any reply will let the scammer know you are an active user, and lead to more frequent harassment later.
Step 2: Visit the official website directly yourself, do not click any unknown links
How to do it: Open the bookmark you saved earlier, or type the official website address directly into the browser address bar, then log in to your exchange account.
Completion check: Go to the "Security Center" or "Device Management" page, check the "Login History" and "Active Devices" sections. Confirm there are no unrecognized devices or IP addresses that you did not use.
Step 3: Initiate a voluntary verification to make a final confirmation
How to do it: Start a small operation within the exchange (for example, initiate a small withdrawal request, you don't have to actually complete it), or modify a security setting. The system will send a verification code to your bound phone number or email.
Completion check: You receive the verification code, and the verification passes. This proves your phone number and email are still under your full control, and the verification channel works normally. If you receive an operation notification text for an action you never initiated, that means someone is trying to log into your account, so change your password immediately and reset 2FA.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Common reason people get scammed: Panic caused by "verification code bombing"
There is one situation that makes people extremely easy to fall for: you get a dozen verification code texts in a very short time, and you panic immediately. That is exactly what attackers want — they use panic to override your normal judgment.
If you do encounter "verification code bombing", stay calm and judge by these two cases:
- Case A: The bombing messages mention "change phone number" or "reset password", this is a high-risk signal. It means scammers are actively trying to access your account. Do not reply to any text messages, log in to the official App immediately, change your password, then enable or reset Google Authenticator.
- Case B: The bombing messages are just random regular verification codes with no specific operation description, which may mean scammers are using scripts to test in bulk if your account is active. Ignore them completely, do not send any replies like "cancel" or click any "block" related actions.
Risk Reminder: One small detail can help you tell real and fake messages apart quickly — Legitimate exchange text messages will only notify you "Withdrawal has been initiated", they will never put any "click to cancel" link in the text message. All cancellation operations must be completed inside the official website or App. Any text message that gives you a link to click to cancel is 100% fake.
Check to confirm you are done: You checked the login history on the official website, and there are no abnormal devices. You can normally receive and pass verification codes when you initiate an operation yourself. If both conditions are met, your account is safe for now.
Next steps: Save the official websites of the crypto exchanges you often use to your browser bookmarks, and only access them through bookmarks later. Go to the Security Center to turn on the "Anti-Phishing Code" feature if you haven't done that yet. Then go through the "Security Guide" or "Anti-Scam Statement" in the official help center, spend 3 minutes reading the common scam patterns listed by the official. This is way more effective than asking others for help after you run into a problem.
