One-time passcodes, app approvals and screen sharing: the three things never to share

Your bank's security codes are the keys to your money. Criminals know they can't break the lock, so they talk you into handing over the key. Almost every modern bank scam ends with one of three things: you read out a code, you tap "approve" in your app, or you let someone see or control your screen.

1. One-time passcodes

A one-time passcode (OTP) is the six-digit code your bank texts or shows in its app to confirm a payment, a new payee, a card added to a phone wallet, or a login. If someone else has your card number or password, the code is the only thing stopping them.

Criminals get it by phoning you with a story: "we've blocked a suspicious payment, read me the code we've just sent so we can cancel it", "we need to verify it's you", "confirm the code to receive your refund". The code they're asking for is the one they triggered by trying to pay with your details.

• Read the text before you do anything. It usually says what the code is for: "to pay £900 to …", "to add your card to Apple Pay". If that's not something you're doing, it's a scam.
• No bank, shop, courier or government department will ever ask you to read a code out. Not to cancel a payment, not to verify you, not for any reason.
• Never type a code into a website or app that someone else sent you to, or forward it by text.

2. Approving things in your banking app

Many banks now ask you to approve logins and payments in the app instead of with a text code. Criminals use the same trick: "tap approve to cancel the fraudulent transaction", "approve to confirm your identity". What you're really approving is their payment or their login.

• Read the approval screen. It shows the amount, the payee and the device. If you didn't start it, press reject or deny and call your bank.
• An unexpected approval request means someone has your password. Reject it, then change your password and tell your bank.

3. Screen sharing and remote access

If a caller asks you to share your screen on WhatsApp or a video call, or to install an app such as AnyDesk, TeamViewer, Zoho Assist or "a security update", they can see every code that arrives, every password you type and every balance you have. With remote control they can move your money while you watch, or while they ask you to "leave it running".

The Financial Conduct Authority is blunt about it: being asked to share your screen or give remote access to your phone or computer is a warning sign of a scam. Banks and genuine investment firms never need it.

• Never share your screen with someone who contacted you. That includes "bank fraud teams", "tech support", "investment advisers" and "HMRC".
• Never install software or an app because a caller told you to.
• If you already did: turn off the internet or switch the device off, call your bank on 159 from another phone, then uninstall the app and change your passwords. More on remote access and malware scams.

Where the scam calls come from

Criminals usually already have something: your card number from a fake shopping site, your password from a data breach, or your name and bank from a phishing text. The code call is the last step. That's why it helps to check websites before paying, use a different password for your email and bank, and ignore links in unexpected messages. See phishing for the messages that start it all.

If you shared a code or approved something

Last reviewed: October 2026