That’s my face. That’s not me.

A familiar name, profile picture, or old conversation does not prove who is sending a new message. Accounts can be taken over, and scammers may impersonate someone you know.

In this story, someone using Sam’s account asks for a code “sent by mistake.” The service message says it is a sign-in code for Leo. Forwarding it could help the attacker access Leo’s account.

Keep login and recovery codes private. If a friend makes an unexpected request, talk in person or use a contact method you already trust. Asking “is this you?” in the same chat lets whoever controls the account answer.

If you already shared a real code, immediately open the service’s official app or website to secure or recover your account. Change a compromised password, review signed-in sessions, and check recovery settings. Report the suspicious message through the service’s reporting tools. Warn your friend through a separate trusted channel.

Keep learning with Passwords and multifactor authentication, Passkeys and phishing resistance, or the Identity & Access Management career track.