A one-time password (OTP) or verification code is often used to prove that you control an account, phone number, or transaction. If you gave that code to someone else, they may be able to use it before it expires.
Act quickly. Start by securing the account or service the code was meant for. If you still have access, change the password and review recent sign-ins, devices, recovery details, and other security settings.
If the code was connected to banking, a payment, or a financial account, contact the bank or financial provider using an official number or app and explain exactly what happened.
Do not give anyone another code to 'cancel', 'reverse', or 'secure' the first one. A legitimate support team should not need you to read an OTP back to them.
If you notice unauthorized activity, use the relevant incident guide below for the next steps.