The message comes from someone you know. They say a verification code was sent to your number by mistake and ask you to forward it. The code is real — it was triggered by someone registering your number on a new device. Forwarding it hands over your account.
What happens next
The attacker now messages your contacts as you. Typically they describe an emergency and ask for a transfer, or send the same code request onward to spread. Because the message genuinely comes from your account, with your photograph and history, people comply. Your family and clients lose money in your name.
The protection that actually works
Enable two-step verification in your messaging app's privacy settings. This sets a PIN that is required in addition to the SMS code when registering the account on a new device. Even if a code is intercepted or forwarded, registration fails without the PIN. It takes a minute and prevents nearly all of these takeovers.
If your account has been taken
- Register the number again on your own device — receiving a fresh code usually logs the attacker out.
- Enable two-step verification immediately afterwards.
- Tell your contacts through another channel that your account was compromised and any money request was not from you.
- Check linked devices or web sessions and remove any you do not recognise.
If a contact received a request
Anyone asked for money by a message alone should call the person on their known number before sending anything. That single habit stops this scam, and the family-emergency variants that work the same way.