Never Bypass MFA

Multi-factor authentication codes exist specifically to prove that a login attempt is really you, on a device you control. The moment someone — a caller, a text, an email, even one claiming to be your own bank or IT department — asks you to read that code back to them, the scam has already succeeded in getting you to the final step; they're just waiting on you to hand over the key.

This is one of the clearest, most absolute rules in this whole area, because there is no legitimate scenario where a real company or person needs you to speak or type a one-time code to them. Automated systems verify the code on their own end when you enter it directly into the real login screen — nobody needs you to relay it.

If you receive an unexpected MFA code at all, that's also worth treating as a signal: it usually means someone already has your password and is attempting to log in, which is itself worth acting on — changing that password immediately, through a channel you navigate to yourself.

• The rule, no exceptions: Never read or type a one-time code into anything except the real login screen.
• If asked: It's a scam, every time, regardless of who they claim to be.
• Unexpected code received: Treat it as a sign someone has your password — change it right away.
• Remember: Automated systems never need a human to relay a code to them.