The 6-digit code scam: how it works and how to stay safe
It usually starts politely. A message arrives from a stranger, or worse, from a friend's account: "Hello, I sent you a 6-digit code by mistake. Please can you send it back to me?"
A moment later, an SMS really does arrive with a code. It feels harmless to forward it. It isn't.
What is really happening
The scammer is trying to sign in to your account on their phone, using your phone number. The app sends the sign-in code to you, the real owner. The only way they can finish is if you hand it over. Once they have it, they can message your contacts as you, asking for "urgent" loans, transfers or more codes. The same trick is used for bank and mobile money accounts.
The one rule
Never share a code you received by SMS or email, with anyone, for any reason. GistUp will never ask you for it. Your bank will never ask for it. A real friend will not ask for it either.
How GistUp helps
- Scam warnings: when a message asks for a code, BVN, NIN, PIN or money, or carries a suspicious link, GistUp shows a warning under it. The check happens on your phone; we never read your messages.
- Message requests: strangers land in a separate list, so their message never sits among your real chats looking trustworthy.
- Registration lock: turn on a 6-digit PIN in Settings. Even if someone gets your SMS code, or swaps your SIM, they still can't sign in without the PIN.
- Block and report: one tap, and the person is not told.
Other red flags
- A friend suddenly asking for money "urgently", especially to an account in someone else's name. Call them on their normal number before you send anything.
- Prizes, grants or jobs you never applied for that need a "small fee" first.
- Links that look almost right, with an extra letter or a strange ending.
- Pressure to act right now. Scammers hate it when you slow down.
Read more in our safety tips, and see how to turn on registration lock.