A buyer asked me to read out a text code. Should I?

Why would a buyer want a text code?

A code in a text is often the second step that proves a login, or the code that registers a phone number on a new device. The National Cyber Security Centre says not to share verification codes. It says attackers try to obtain a login or account-recovery code so they can add their own device.

The NCSC article is about messaging apps and social engineering in general. It is not a count of Facebook Marketplace cases. The instruction is still the right one when the person asking is a buyer: do not share the code.

The NCSC says anyone can be caught by social engineering. Its messaging-app warning tells people not to share verification codes and not to scan an unexpected QR code. It says attackers may try to obtain a login or account-recovery code so they can add their own device. Source

What does Facebook say if the message is on Marketplace?

Facebook’s Marketplace safety help says not to answer a message or email that asks for a verification code, your email address or your password. It says Facebook will never ask you for your password.

A buyer is not Facebook. A page that looks like WhatsApp, email or your bank, sent in the chat, is not the place to type the code. Open the real app yourself if you need to check a login. Do not scan a QR code from the chat either. The NCSC says not to scan an unexpected one.

Facebook’s Marketplace safety help says not to answer a message or email that asks for a verification code or for account information such as your email address and password. It says Facebook will never ask you for your password. Source

Facebook’s Marketplace safety help says local pickup items paid person to person are not covered by Purchase Protection, and that Facebook does not offer refunds for person-to-person transactions. It says to avoid payment links and to log in through the payment service’s own website. It also says not to share financial information, such as a PayPal login or bank details, and to reject an overpayment that the buyer then asks you to send back. Source

I already read the code out. What now?

Open the account the code belonged to, from the app or a site you type yourself. Look for a new device, a changed email, or a login you do not recognise. Use that service’s recovery steps. If the text was from your bank, call the bank on a number you look up, not the number in the text.

Change the password on that account, and turn on the extra check the service offers, from its own settings. Tell contacts if messages start going out that you did not write. Do not send a further code to “fix” it.

Where should I read next?

Read fake payment emails, marketplace scam checks, “is this still available”, “Hi I'm interested” on Gumtree and SilentSale® vs Facebook Marketplace.