A buyer wants a verification code. Your listing is not what the code verifies.
When a stranger asks you to prove you are real by forwarding a code, read which service sent it and what action it authorizes.
Selling a used item involves a small negotiation about trust. The buyer wants evidence that the listing is real; the seller wants a genuine buyer. A code request exploits that reasonable concern by presenting account verification as a test of your honesty.
The crucial question is not “Am I a real seller?” It is “Which service generated this code, and what would sharing it let another person do?” A code from an account provider does not become a marketplace safety check because a buyer calls it one.
How the trust test gets reversed
In an ordinary transaction, a seller can answer questions about the item, explain its condition and agree on a platform-supported payment or collection method. A stranger does not need to control an unrelated account to assess whether a chair, phone or game console exists.
The suspicious request changes the test. Refusing to provide a code is framed as evidence that you are dishonest. That puts you on the defensive: you start trying to demonstrate good faith rather than examining the requested action. A fair transaction should not require surrendering a security secret to avoid appearing rude.
The FTC’s Google Voice warning describes one documented version: people posting items or missing-pet notices are asked to relay a Google Voice verification code. The code can be used in setting up a number associated with the person’s phone. That is not verification of the listing.
Not every code request has the same consequence
“I gave them a six-digit code” does not identify the exposure by itself. Different services use short codes for different actions. The message, issuing service, account history and actions you took matter more than the code’s length.
| The message relates to | The question to answer | Where to check |
|---|---|---|
| Creating or linking a phone service | Was your phone number associated with another account or service? | The issuing provider’s official account and help pages |
| Signing in to an existing account | Did another session gain access? | Account activity and security settings |
| Resetting a password | Were credentials or recovery details changed? | The provider’s recovery process |
| Approving a transaction | Was a payment, payee or card action authorized? | Your bank or payment provider |
| A platform’s normal transaction flow | Did you initiate the action in the real app? | The app opened independently, not a buyer’s link |
This table is a triage tool, not a diagnosis. A code may expire without being used, or it may already have authorized an action. Do not assume the best or the worst from the digits alone. Check the service that actually generated it.
A safe response before anything is shared
Keep the conversation on the marketplace where possible and follow its published process. You can tell the buyer you do not share account verification codes. You do not need to send a screenshot to prove that the message contains a warning; the screenshot may itself contain the code or other private information.
If the person insists that every seller must complete the test, open the platform’s help area yourself. Do not use their “verification” link to investigate whether their verification process is genuine. That circular check asks the same unverified party to supply both the claim and the evidence.
Avoid moving the transaction to a different app solely because the buyer says the marketplace is broken. Moving off-platform is not proof of fraud on its own, but it can remove records and protections you expected to have. A code request combined with a hurried move to another channel deserves particular caution.
If you already sent the code
First preserve the original message so you can identify the service and stated purpose. Do not send a second code to undo the first unless you initiated a genuine recovery action through the provider’s own process. A stranger claiming the first code “failed” may simply be asking for another opportunity.
Open the real account or official support page independently. For a sign-in or password-reset code, review access, recovery contact details and active sessions. If you cannot sign in, use the official recovery workflow. If the message concerned a bank or payment action, contact that provider immediately rather than treating it only as a social-media problem.
For a Google Voice linking issue, follow Google’s current provider guidance rather than a social-media tutorial that asks for additional codes. The FTC warning links to the relevant provider information. Procedures and eligibility can change, so a generic article cannot promise that a particular menu will appear on every account.
The FTC’s identity-theft guidance is useful when personal information was exposed beyond the code. However, sharing a code does not automatically mean every identity document or bank account is compromised. List the actual actions and respond to each one.
The payment screenshot is a separate claim
Some marketplace conversations combine a code request with a screenshot showing payment or a message saying you must upgrade an account to receive money. Treat those as separate claims. Check the transaction in your own account, opened independently. Do not ship an item because the buyer’s image looks like a familiar payment app.
If an apparent overpayment arrives and the buyer asks you to send the excess elsewhere, contact the payment provider before moving money. A notification, a pending balance and a settled transaction are not always equivalent. For check-based arrangements, the FTC explains why apparent availability is not proof that a check is genuine.
The goal is not to learn every possible marketplace trick. It is to stop allowing the counterparty’s messages to stand in for your own account records. An actual sale should be understandable through the platform and provider you chose, not only through a stranger’s explanation of them.
What to preserve and what not to post
Keep the listing URL, the account name, the original message, the time of the exchange and any actual transaction reference. Report the profile through the platform’s reporting function. If you post a general warning to others, redact phone numbers, account identifiers, addresses and codes.
Do not attempt to identify or confront the real person pictured in the profile. A photograph or name may belong to someone whose identity was copied. Your useful evidence is the account and interaction you encountered, not an assumption about the person behind the image.
If the other party threatens you after you stop responding, preserve the threat and use the platform’s safety tools. For an immediate physical threat, contact the appropriate emergency service. Do not agree to an in-person meeting to “clear things up.”
A repeatable boundary for future listings
Before publishing another listing, decide which communication and payment methods you will use. Keeping that boundary consistent reduces the need to improvise while a buyer pressures you. You can still be polite and flexible about ordinary details such as collection time without changing your account-security rules.
The same principle applies outside marketplaces. A recruiter, supposed support agent or new online contact may ask for a code under a different label. The purpose written by the issuing service is more important than the story told by the person requesting it.
Is it safe if I only shared my phone number?
A phone number is not the same as a one-time code. It can still lead to follow-up messages or attempts to use it in another service. Do not provide additional codes or information just because the person already has the number.
Should I delete the conversation immediately?
Preserve the relevant records first if it is safe to do so, then use the platform’s block and report tools. Do not revisit suspicious links to improve your evidence.
If the exchange was a supposed job rather than a sale, see the task-deposit pattern. If a stranger now offers to fix the account for a fee, read the recovery-scam warning.
Found a factual error or a source that has changed?
Send a correction →
