New Text Scams Send Fake MFA Codes and Password Reset Links

Summary

• Recently, an Identity Theft Resource Center (ITRC) staff member received a text message with a “verification code” to log in to their Coinbase account. However, they had not tried to log in. Another employee received a text message to reset their Instagram account password, despite not attempting to do so. 
• Scammers are using these new text scams in hopes that you will think someone is attempting to misuse your information, leading you to act and either call a phone number or click on a link in the text message. 
• Depending on the information they steal, whether it is in a multi-factor authentication (MFA) scam or another form of text scam, they can commit a range of identity crimes that could lead to account takeover, financial identity theft and more. 
• To avoid text scams like these, never act or respond to unsolicited text messages with codes, links or phone numbers. Go directly to the account and reset your password to make sure no one can access it. 
• Use an authenticator app for any accounts with MFA since phone calls and text messages can be spoofed. Also, switch to passkeys when possible because identity thieves cannot steal them, as they are credentials unique to you and only you.  
• If you have additional questions about these new text scams or believe you were the victim of an identity crime, contact the ITRC. You can reach us toll-free by text or phone (888.400.5530) or live chat on the company website, www.idtheftcenter.org.   

Everyone has received those text messages or phone calls that provide a code to log in to an account. Multi-factor authentication, also known as MFA or 2FA, is a security enhancement that requires users to provide multiple forms of verification to access an account or system. While it is meant to be an added layer of security, scammers are using it against you. They’re also trying to trip up consumers with texts that include fake password reset links. New text scams are circulating. Here’s what you need to know. 

Who Are the Targets?

Cell phone users; people with online accounts 

What Are the Scams?

A staff member at the Identity Theft Resource Center (ITRC) recently received the following text message with a “verification code”: 

However, the employee did not try to log into a Coinbase account. In this MFA scam, scammers pretend they are sending an MFA code when you either do not have an account or have not tried to log into it. They hope that you will think someone is attempting to misuse your information and that you will be motivated to reach out to them. 

It does not have to be just a fake MFA code. Another ITRC employee received a text scam that asked them to reset their Instagram password, despite not trying to log in to the social media platform. 

What They Want

Scammers hope these new text scams will pressure you into calling the phone number or clicking on the link, allowing them to steal any information they can. Depending on the information they steal, whether it is in an MFA scam or another form of text scam, they can commit a range of identity crimes that could lead to account takeover, financial identity theft and more. 

How to Avoid These Scams

• Never act or respond to any text messages with codes, links or phone numbers that you were not expecting. If you have an account with any of the accounts referenced in the text message, go directly to the account and reset your password to make sure no one can access it. If you do not have an account with the referenced company, contact them separately using legitimate contact information from their company website to make sure an account was not opened using your information. 
• Use an authenticator app for all of your accounts that use MFA. An authenticator app cannot be spoofed like text messages or phone calls. 
• Switch to passkeys when possible. A passkey eliminates account takeover due to stolen passwords or spoofed MFA texts and phone calls. Identity thieves cannot steal it because it’s a credential that’s unique to you and only you.  

Contact the ITRC

If you have additional questions about MFA scams, other new text scams or believe you were the victim of an identity crime, contact us. You can speak with an ITRC expert advisor toll-free by text or phone (888.400.5530) or live chat on the company website. Just visit www.idtheftcenter.org to get started.