They ask for a text-message code
Banks and government agencies do not ask you to read out a text-message code or a password. The code confirms an action in your name, so whoever gets it can sign in to your account or make a transaction.
Security
Security
Digital safety at home rests on a few simple habits: never read out codes over the phone, use different long passwords and keep your router up to date. This section covers how scammers typically operate by phone and in messaging apps, what current NIST guidelines say about passwords, how to protect your home network and what to do if a mistake has already happened.
If a call rushes you, frightens you and demands that you act right now, that alone is reason enough to hang up.
How this section works: it includes rules that suit anyone and need no technical knowledge. We do not publish fraud statistics or ways to get around security measures.
Scammers on the phone and in messaging apps
Common signs that make a scam attempt easy to recognise.
They offer a "safe account"
A request to move money to a "safe" or "backup" account is a sign of fraud. A real bank never does this.
They call on behalf of an agency
The caller gives a job title or a case number and threatens an investigation or a blocked account. If in doubt, hang up and call back yourself, using the number on the official website or on the back of your bank card.
A message "from a friend"
A message from someone you know asking to borrow money urgently or to vote via a link may come from a hacked account. Call that person through your usual phone line and check.
Passwords and sign-in
What NIST SP 800-63B-4 (2025) recommends.
Length beats complexity
If a password is the only way to sign in, it should be at least 15 characters long. With multi-factor authentication, a password of 8 characters or more is acceptable. Services should allow passwords of at least 64 characters.
No mandatory "special characters"
NIST does not recommend rules like "must include a number, a symbol and a capital letter": they make passwords more predictable, not stronger.
Change for a reason
There is no need to change your password on a regular schedule. Change it when there are signs it may have fallen into someone else's hands.
Checks against breaches
Services should check new passwords against lists of breached and commonly used ones. If a service rejects your password as known, come up with a new one rather than adding a digit at the end.
Home network
Three router settings worth checking.
WPA3 security
Choose WPA3 security in your Wi-Fi settings. If some devices don't work with it, use WPA2.
WPS turned off
It's better to turn off the WPS quick-connect feature: the convenience isn't worth an extra way into your network.
Router updates
Check whether a new firmware version is available for your router and install it. While you're there, change the default admin password.
What to do if you have already shared a code
- Call your bank immediately on the number from its official website or your card and ask them to block the card and any suspicious transactions
- Change the password for the account the code belonged to, and for the email linked to it
- End sessions on unfamiliar devices in your account settings, if the service allows it
- Turn on a second sign-in factor if it wasn't already on
- Warn your family and friends: someone may message them from your account pretending to be you
- Keep the phone numbers, messages and call times: you will need them when contacting your bank and the police
Related sections
- Practical guides
A step-by-step article on getting your home tech in order over a weekend, plus the article catalogue.
- Tools
What helps at home for your network and your data: router, mesh system, external drive, cloud, password manager.
- FAQ
Short answers about home internet, devices, backups and online services.
Sources
- NIST SP 800-63B-4
- Wi-Fi Alliance
- Gosuslugi (Russian public services portal)
Service features, device settings and password requirements change over time. Before taking an important step, check the official help pages of the manufacturer, your internet provider or the government service.