I was pulling a pan of banana bread out of the oven when my mom called to ask whether it had been all right to read a six-digit number to a man who said he was from her bank. She had read it out loud because he already knew her name, the name of her bank, and the last four digits of her card, and because he stayed on the line sounding patient while she found her phone. Here is the plain version of what happened: that number was the key to her account, and she had just handed it to a stranger. Learning how to avoid online scams for seniors is not about memorizing a hundred tricks. It is about understanding a few small machines well enough that no one can talk you into opening a door for them.
The paragraph below explains what that number was, why it existed, and exactly what to do if you have ever read one out loud yourself.
What a One-Time Passcode Actually Is
A one-time passcode — also called a verification code, a one-time password, or simply a code — is a short number, usually six digits, that a company texts to your phone when someone tries to sign in to your account, change your password, add a new payee, or send money. You may see it described as two-factor authentication, which just means a password plus a second proof that the person signing in is really you. Your phone is the second proof.
What the code is | What the code is not |
|---|---|
A second key that only your phone receives | A password you keep and reuse |
Sent the moment someone tries to sign in or move money | Something a bank employee needs to hear from you |
Useful for a few minutes, then worthless | Proof that the person calling you works at your bank |
The detail that makes everything else make sense is this: if you did not ask for the code, then somebody else did. The text is real. It came from your bank. It arrived because a stranger is, at that very moment, trying to get into your account. Holding on to that one fact is most of how to avoid online scams for seniors, because it turns a confusing message into a simple decision.
How the Scam Unfolds: The Code Is Real, the Caller Is Not
This scam is confusing because almost nothing in it is fake. The code is genuine, the bank is genuine, and the phone number on your caller ID may even look familiar. The only false part is the person.
The sequence usually runs like this.
The scammer already has your username and password, often after you typed them into a page that copied your bank's design — which is why what to do after clicking a phishing link matters here
They try to sign in. Your bank sends a real code to your phone
They cannot see your text messages, so they call you and introduce themselves as the fraud team
They keep you talking so the code does not expire: "Read me those six digits and we can stop the fraud right now"
You read them. They type them. The transfer completes in seconds
The thing to hold on to is that the code is doing its job. It is the one lock the caller cannot pick. Reading it aloud is not a small mistake that the bank can wave away — it is turning that lock from the inside.
What a Real Company Will and Will Not Ask
A bank employee may ask for a code, but only in one situation: you called the bank first, using the number on your card or statement, and you are signing in during that same conversation. Even then, if something feels off, you can hang up and start over. It is your account; nobody will be annoyed.
A real bank, a real utility, a real delivery company — none of them will do any of the following.
Call you out of the blue and ask you to read a code aloud
Ask you to move money to a "safe account" while they investigate
Ask for your password, your PIN, or the full number on your card
Keep you on the phone with a countdown while you look for something
One sentence is worth memorizing and repeating to family members: I never read a code to someone who called me. If someone is rushing you, that is a reason to slow down, and a real bank will happily wait. Say that sentence out loud a few times and how to avoid online scams for seniors becomes a household habit instead of a warning.
If You Already Read a Code Aloud, Do These Five Things
Act today, not tomorrow. Speed is on your side here, and banks have fraud teams whose entire job is this exact situation.
Call your bank on the number printed on your card and say plainly: "I shared a one-time code with a caller today"
Ask them to freeze the account and stop any pending transfers while you are on the call
Change your password from the bank's app or website, and change it anywhere else you used the same one
Turn on extra sign-in security in the bank's app so a password alone is never enough — opening Settings will not undo anything, and you are not going to break the phone by looking at this screen
Write down what happened: the time, what the caller said, the number that appeared, and the name they used
Then watch your account closely for a few weeks, and ask the bank to send alerts for every charge. If the call began with a link you tapped, treat it exactly like what to do after clicking a phishing link: change the password first, then watch the account, then call the bank.
Making the Code a Family Rule
My mother called the bank within twenty minutes, and the transfer was stopped. What she remembers from that afternoon is not the money. It is that she felt foolish, which is the feeling these callers depend on. So we made a rule that fits on one line and now sits at the top of my handwritten "things Mom may ask about" list: nobody reads a code to a caller, ever, including me.
Our daughter Lila, who is twelve, has started hearing that rule when she sets up new accounts for school projects, and Miles, who is nine, likes to announce it at dinner. A rule repeated by a nine-year-old is a rule that sticks. Let's make the next click the easy one.