Nobody legitimate asks for the code

One rule, and it covers more ground than almost anything else you could learn:

Nobody legitimate will ever ask you for a code that was sent to your phone.

Not your bank. Not a delivery company. Not a buyer on Marketplace. Not a friend. Not support for any service you have ever used. Nobody.

Why the requests sound reasonable

Because they are dressed as safety:

"I'll send a code to verify you're a real seller." They have entered your number into a service — Google Voice, WhatsApp, a password reset — and the code arriving is the last thing standing between them and your account.

"This is your bank's fraud team. To confirm your identity, read back the code we just sent." Real banks send codes for you to type into their own app or website. They never ask you to say one aloud.

"I've accidentally sent my verification code to your number, could you forward it?" Reasonable, neighbourly, and false. The code is yours, not theirs.

"Your parcel needs rescheduling, confirm with the code." Delivery firms do not verify by code.

The WhatsApp version

Common enough to name separately. A message from a friend's hijacked account asks you to forward a six-digit code sent by mistake. That code registers your WhatsApp on their device. Sending it hands over your account, and their next move is to ask everyone in your contacts for money.

Turn on two-step verification in WhatsApp: Settings, Account, Two-step verification. It adds a PIN that a stolen SMS code alone cannot beat. One minute, and it stops this outright.

The only time you type a code

Into a site or app you opened yourself, during a login you started, seconds ago. That is the entire legitimate use.

If a code arrives when you were not signing in, that is not an admin error. It means somebody is trying to get into your account right now, with your password. Do not enter it anywhere. Go and change that password.

If you already read one out

Assume the account is taken and move fast:

1. Go to the service and change the password. 2. Sign out all other sessions. 3. Check the recovery email, recovery phone and any forwarding rules for changes. 4. Turn on two-factor, or replace it if it was changed. 5. Tell your contacts — the account will be used against them next.

For WhatsApp specifically: re-register with your own number straight away. That kicks them off, because the account follows the SIM.

Teach this one sentence

To your parents, to your children, to anyone. It defeats several completely unrelated scams at once and needs no technical understanding:

If anyone asks you for a code, they are stealing from you. There is no exception.