Google Voice Code Scam: Why They Want Those 6 Digits

Google Voice Code Scam: Why They Want Those 6 Digits

You post a standing desk on Facebook Marketplace at 7:12 on a Saturday morning. By 7:20 someone wants it. They're very interested, very polite, and they'd like to confirm you're a real person first, because "there are so many fake listings." A text shows up on your phone with a six-digit code. Could you read it back?

Don't. That's the Google Voice code scam, and the code is not a handshake. It's the key to a phone number that points at you.

How the Google Voice code scam actually works

Here's the script, start to finish. It's boring, which is why it works.

1. They find you. You've posted a listing with your phone number or they message you through the platform. A for-sale item, a lost pet, a sublet. Anything that makes you easy to reach.
2. They ask you to "verify." Per the FTC warning as reported by KTVU, the scammer asks for your number, saying they want to confirm you're not running a fake listing.
3. They trigger the code themselves. While you're chatting, they start setting up a Google Voice account with your number. Google texts you a verification code. You didn't ask for it. They did.
4. You read it back. Now they can finish the setup. Bitdefender describes the result: your real number becomes a forwarding line for a brand-new Google Voice number that belongs to them.
5. They go to work. With a Google Voice number attached to your phone, they can place calls and texts that hide who they really are. Per the same KTVU report, they may also use your name and number to get into other accounts.

Then the "buyer" vanishes. They never wanted the desk. They wanted the number. I'll be honest, the audacity of pretending to run a fraud check on you while committing the fraud is a special kind of nerve.

Why this one is harder to spot than a phishing text

Most scam texts ask you to click something, and that's a visible red flag. This one asks for nothing but a few digits. The message that reaches you is a real Google verification text, sent by Google, to your real phone. There's no spoofed sender, no misspelled link, nothing for your gut to flag.

It also flips the usual script. The scammer plays the cautious one. They sound like the person worried about getting scammed, and they ask you to prove yourself. That inversion makes the request feel reasonable, even responsible.

The honest tell is simple: a verification code only ever has one job, proving that you control your phone to the service that sent it. The moment a second person is involved, it stops being verification and becomes a handoff. The same logic is behind the WhatsApp verification code scam and the Amazon sign-in code scam. Different platform, same trick.

The red flags hiding in plain sight

• They ask for a code that was sent to you. Nobody legitimate needs it. Not buyers, not "support," not a friend you've never met.
• The code arrives while you're mid-conversation. If a text from Google shows up right as someone asks for your number, that's not a coincidence.
• They want to "verify" you before doing anything else. Real buyers ask about the item. Scammers ask about you.
• You never asked for the code. An unrequested verification text means someone else is using your number somewhere.
• They push you to hurry. "I'm at work, can you just read it to me real quick?" Urgency is how they keep you from thinking.
• They've moved you off the platform. Moving from the marketplace chat to text or a call strips away the platform's guardrails.
• No interest in the actual item. No questions about size, condition, or pickup time.

If you already read them the code

First, you didn't do anything dumb. The request was engineered to sound reasonable, and the text really did come from Google. Here's what to do, in order.

1. Reclaim your number. On a computer, open Google Voice, go to Settings, and under Linked numbers add your phone number as a new linked number. Bitdefender walks through this, and the FTC warning as reported by KTVU says to follow Google's "reclaim your number" steps. This detaches your phone from the scammer's account. It's worth doing quickly, since the scammer may be using the number for other scams in the meantime. You may need a Google account to do it.
2. Lock down the accounts tied to your number. Turn on two-factor authentication on your email, marketplace, and financial accounts, ideally with an authenticator app rather than text codes. Experian also recommends changing passwords on financial and app accounts and watching your statements.
3. Watch for strange activity. Keep an eye on your credit reports and account statements for anything unfamiliar.
4. Report it. File at ReportFraud.ftc.gov, with the FBI's IC3, and with the BBB Scam Tracker. If you want the full playbook for after you click or share something, see what to do after you clicked a scam link.

If someone is texting you, claiming to be a buyer and sending codes you didn't request, you can paste the messages into the Cautellus scam text checker to see which manipulation tactic they're running before you reply.

How not to become the next victim

• Treat every code like a house key. If it was texted to you, it stays with you. No exceptions, no explanations needed.
• Say no in one line. "I don't share verification codes." Then stop replying. You owe a stranger no further explanation.
• Keep your number off public listings. Use the platform's built-in messaging. Selling something is easier to do without handing out your phone number.
• Meet in public and take payment in person. This is the ordinary marketplace advice that also kills most of the other tricks in online marketplace payment scams.
• Check your own Google Voice status. If a verification text lands that you didn't request, don't ignore it. Someone is trying to use your number, so tighten your account security.
• Secure the Google account behind it. Add an authenticator app or a security key so a stolen code can't walk anyone into the rest of your life.

This is one of the clearer examples of how text-message fraud works in general. If you want the wider map, the text message scams hub covers the other versions, and Google has its own impersonation page.

FAQ

Why do scammers want my Google Voice verification code? The code lets them finish setting up a Google Voice number that is tied to your real phone number. They get a clean-looking number to run other scams from, and the trail points back to you instead of them.

I gave someone the code. What do I do first? Reclaim your number through Google Voice on a computer (Settings, then Linked numbers) so the scammer's account loses its link to your phone. Then lock down your email and marketplace accounts with an authenticator app, and report it at ReportFraud.ftc.gov.

Can they get into my bank account with just the code? Not from the code alone. The code sets up a Google Voice number against your phone number. The bigger risk is that your name and number get used to impersonate you or to try account recovery elsewhere, which is why you should tighten security on accounts that use your phone number.

Is a buyer asking to verify my phone number ever legitimate? No. A real buyer doesn't need a code sent to your phone to prove you exist. Codes are meant for you alone, and anyone asking you to read one back is running a play.

Does this only happen on Craigslist and Facebook Marketplace? Those are the classic spots, but the opener travels. It shows up anywhere you post your phone number publicly: for-sale listings, lost pet posts, sublets, and similar.

How do I report this? Report it to the FTC at ReportFraud.ftc.gov, file a complaint with the FBI's IC3, and add it to the BBB Scam Tracker. Reports help investigators see the pattern even if you lost nothing.

Sources: KTVU report on the FTC's Google Voice verification warning (Oct. 27, 2021), Bitdefender, Experian.

The next time a stranger says they need to "verify" you, remember that the only thing getting verified is how far they'll go to sound polite.