Sign-in codes

Why Is a Website Asking Me for a Sign-In Code?

After you type your password, some websites send a short code by email or text message and ask you to type it on the sign-in page. The code is an extra check that the person signing in is you. A website often asks for one when you sign in on a computer or phone you have not used with it before.

Where to type the code

Type the code in the box on the website’s page that asked for it. Keep that page open while you read the email or text message, then return to the page, type the code and click or tap the button under the box, such as Verify, Continue or Submit. Some pages move on by themselves after you type the last character; then you do not need the button. You only need to read the code. You do not need to click a link or button in the message.

A code works for a short time only. If the website says the code is wrong or has expired, use its button to send a new code, such as Resend code, and type the code from the newest message.

On a phone, these steps show how to read the code in your email and go back to the website without closing it: Android phone, iPhone.

If someone asks you for the code

Keep the code to yourself. It is only for you to type on the website. A caller, a text message, an email or someone you met online may ask you to read the code out or forward it, sometimes saying they are from your bank or a company you know. Do not give it. End the call or stop replying.

If you are worried about the account, contact the company yourself, using the website or app you normally use or the phone number on your card or statement. Do not use a number or link from the person who asked.

If a code arrives when you were not signing in, do not type it anywhere or share it. You can delete the message.

If you already gave someone the code

1. Sign in to that account through the website or app you normally use, and change its password. If your password no longer works, click or tap Forgot password? on the sign-in page and follow its steps. If that does not work either, contact the company using its website or app, or the phone number on your card or statement.
2. If it is a bank or card account, or you sent money, call the bank or card company using the number on your card or statement, and tell them you gave a sign-in code to someone.

Read Google’s explanation of when it sends a sign-in code and the FTC’s alert about people who ask for your code. You can report someone who asked for your code at ReportFraud.ftc.gov.