You have seen the messages: “Your verification code is 482915. Do not share this code with anyone.” Most people skim past the warning. Fraudsters count on that.
A one-time password, or OTP, is a short code sent by text, email or app to prove that you are the person doing something: logging in, resetting a password, approving a payment or setting up WhatsApp on a new phone. It is valid once, usually for a few minutes.
Why the code matters so much
Your password or PIN proves you know something. The OTP proves you have your phone. Together they make it hard for anyone else to get in. But if you tell someone the code, you have handed them the second key. With it they can:
- Reset your password and lock you out.
- Approve a payment or transfer you never made.
- Take over your WhatsApp and message your contacts for money.
- Link your account to their device.
The code is for the app, not for a person. If a human being asks you for it, the answer is no.
How fraudsters get people to share codes
“I sent you a code by mistake”
A message from a friend’s account, or a stranger, says they sent a code to your number by accident and asks you to forward it. In reality, they started a login or WhatsApp setup with your number, and the code is for your account.
Fake customer care
A caller says they are from your network or bank. There is a problem with your account, or you qualify for a bonus, and they will “send a code to confirm”. They then ask you to read it out. Ghana’s Chamber of Telecommunications and the networks have warned repeatedly that staff will never ask for your PIN or codes.
Fake links and forms
A message links to a page that looks like your bank or a promotion. It asks for your number, then for the code you receive. Anything you type goes straight to the fraudster.
The prize that needs “verification”
You have won airtime, a phone, or a cash prize, and you just need to “verify” with the code you are about to receive.
Read the whole message
Many OTP messages say what the code is for: “to log in”, “to approve a transfer of GH₵500”, “to register WhatsApp on a new device”. If you did not start that action, someone else did. Do not use the code, and change your password or PIN.
What to do if you already shared a code
- Act immediately. Call your bank or mobile money provider from their official number and ask them to block or freeze the account.
- Change your PIN and password.
- For WhatsApp, reinstall and verify your number to kick the other person out, then turn on two-step verification.
- Report fraud to your provider, the police and the Cyber Security Authority on 292.
The simple rules
- Codes are for typing into the app or website you opened yourself. Never for reading out on a call.
- Never forward a code to anyone, even a friend.
- Read what the code is for before using it.
- Unexpected code? Something is wrong. Secure your account.
This guide was checked in October 2026. Menus and services change, so if something looks different on your phone, check with your provider.
Common questions
Is it safe to share an old code that has already expired?
It is still a bad habit. Codes are short-lived, but scammers often ask for a fresh one while they are trying to log in. The rule is simple: never share any code.
Why do I get codes I did not request?
Someone may be trying to log in to your account or set up WhatsApp with your number. Do not share the code, and strengthen your security.
Can I trust a code request from a friend’s number?
No. Friends’ accounts are often hijacked and used to ask for codes. Call your friend on their usual number to check.
Are app-based codes safer than SMS?
Generally yes, because they are tied to your device rather than your phone number, which helps against SIM swap fraud. Use them where your services offer them.
