One-time codes, explained

A one-time code is a small secret with one job: to prove that whoever types it controls your phone number right now. Kit Pay sends one when you sign in on a device or take certain sensitive steps. It expires quickly, works once, and means nothing to anyone — except an attacker in the middle of stealing an account.

Why scammers beg for codes

Picture the attacker's problem. They know your number; they may know your name. They start signing in as you — and Kit Pay sends the code to your phone, not theirs. Their only move is to make you read it out. So the story arrives: a prize needs confirming, a wrong payment needs reversing, a bank officer needs to verify you, a buyer for your goods needs a code to release funds. Every version ends the same way: tell me the number you just received.

What a code is not

• It is not your wallet PIN — the PIN is chosen by you and approves money actions; codes are sent to you and prove the SIM.
• It is not a receipt or a confirmation of money arriving. Anyone claiming a code confirms their payment to you is running a script.
• It is not something Kit Pay staff ever need. They can see nothing useful in it and will never ask.

If a code arrives that you did not request

1. Do not panic, and above all do not share it with anyone who conveniently calls right afterwards.
2. It can mean someone typed your number — by attack or by typo. The code alone gets them nothing while it stays with you.
3. Open Kit Pay and review your sessions; sign out anything unfamiliar.
4. Repeated unrequested codes are worth reporting through Help in the app, especially if calls follow them.

The deeper pattern — urgency, authority, and a request for a secret — is the same one behind most fraud. Phishing and fake messages teaches the pattern, and verifying your phone number covers the legitimate side of codes during setup.