Asked for a code sent by SMS?

Purpose

A quick check for verification-code scams: answer four questions to find out whether someone is trying to take over your WhatsApp, bank or payment account, and what to do.

Requirements

Anyone can read these guides, no account needed. Some tools require Pro, as indicated in each guide.

Answer four quick questions to find out whether it’s a scam and what to do. Your answers stay in your browser.

How to use it

1. 1

   Did you get a code by SMS without asking for one? A code you didn’t request means that someone tried to log in or sign up with your number.

2. 2

   Is someone asking you for that code? By message, by phone or on WhatsApp: a stranger, “customer support”, a delivery company or a friend’s account.

3. 3

   Is the code for WhatsApp, your bank or a payment app? The text message usually says which service it is for.

4. 4

   Have you already shared the code? Read it out, sent it in a message or typed it on a page someone sent you.

Synthetic example

Your verification code is 482913. Do not share it with anyone.

Interpret the result

Act now: someone may be taking over your account: With that code, whoever has it can log in as you or confirm an operation in your name. Do this right away:

It’s a scam: don’t share the code: No company, bank or friend needs a code that was sent to you. Whoever asks for it wants to use it to get into your account.

Someone tried to use your number: A code you didn’t request means that someone tried to log in or sign up with your number. On its own it’s harmless: without the code they can’t get in.

A normal code, but keep it to yourself: If you asked for the code yourself, it’s normal to receive it. Use it only in the app or on the website where you requested it.

Limitations

Your answers stay in your browser.

Troubleshooting

The security check or API connection did not respond in time. Try again in a few seconds.

Use with the API

What to do about a verification code you received, from four yes/no answers. Returns a verdict, its severity and stable step codes (never_give_payment_codes comes last for a WhatsApp, bank or payment-app code).

Send the JSON body to the tool's own route, or to POST /v2/tools with the tool field added. Both routes return the same result.

POST https://api.nocall.io/v2/sms-code
POST https://api.nocall.io/v2/tools  {"tool":"sms-code","unrequested":true,"asked":true,"sensitive":true,"shared":false}

REQUEST_ID="$(uuidgen)" && [ -n "$REQUEST_ID" ] &&
curl --request POST 'https://api.nocall.io/v2/sms-code' \
  --header "Authorization: Bearer $NOCALL_API_KEY" \
  --header 'Content-Type: application/json' \
  --header "Idempotency-Key: $REQUEST_ID" \
  --data '{"unrequested":true,"asked":true,"sensitive":true,"shared":false}'

import json
import os
import urllib.request
import uuid

api_key = os.environ.get('NOCALL_API_KEY')
if not api_key:
    raise SystemExit('Set NOCALL_API_KEY')

request = urllib.request.Request(
    'https://api.nocall.io/v2/sms-code',
    method='POST',
    data=json.dumps({'unrequested': True, 'asked': True, 'sensitive': True, 'shared': False}).encode(),
    headers={
        'Authorization': 'Bearer ' + api_key,
        'Content-Type': 'application/json',
        'Idempotency-Key': str(uuid.uuid4()),
    },
)
with urllib.request.urlopen(request, timeout=30) as response:
    result = json.load(response)
print(result['data']['result'], result['meta']['unitsCharged'])

import { randomUUID } from 'node:crypto';

const requestId = randomUUID();
const apiKey = process.env.NOCALL_API_KEY;
if (!apiKey) throw new Error('Set NOCALL_API_KEY');

const response = await fetch('https://api.nocall.io/v2/sms-code', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer ' + apiKey,
    'Content-Type': 'application/json',
    'Idempotency-Key': requestId,
  },
  body: JSON.stringify({ unrequested: true, asked: true, sensitive: true, shared: false }),
});
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? 'request_failed');
console.log(result.data.result, result.meta.unitsCharged);

{
  "data": {
    "tool": "sms-code",
    "result": {
      "verdict": "asked",
      "severity": "high",
      "serviceRecoverySteps": false,
      "stepCodes": [
        "do_not_share_code",
        "stop_and_block_contact",
        "call_known_contact",
        "report_number",
        "never_give_payment_codes"
      ]
    }
  },
  "meta": {
    "requestId": "req_example",
    "unitsCharged": 1,
    "usage": {
      "periodStart": "2026-10-01",
      "unitLimit": 20,
      "unitsUsed": 3,
      "unitsRemaining": 17
    }
  }
}

• API reference ↗

Frequently asked questions

Related guides

• Check if a text message is a scam
• Check a link