You got a Venmo verification code you didn't request

A Venmo code you didn't ask for means someone reached the second step of a login on your account. The password worked. The code is what stopped them.

Venmo sits on top of a bank account or debit card, and peer-to-peer transfers are treated as authorized once they go through, so this is worth handling now rather than tonight.

What to do

1. Never read the code to anyone

The follow-up call is the most common way these accounts actually fall. Someone claiming to be Venmo support says there's an unauthorized transfer and asks you to confirm a code to cancel it. Venmo doesn't work that way, and no legitimate support team asks you to recite a verification code.

2. Change your Venmo password, from the app

Open the app or type the address yourself rather than tapping a link in any message. Choose a password you use nowhere else. If the one you just replaced was in use on other accounts, those are exposed too, because the attacker almost certainly got it from a breach of some unrelated service.

3. Secure the email address on the account

Whoever controls that inbox can run a password reset and receive the confirmation. Change its password, and look through the settings for forwarding rules or filters someone else added, which is how access gets kept quietly after a reset.

4. Turn on a PIN and biometric unlock, and sign out of other devices

A PIN or Face ID requirement on the app means a stolen phone or a live session isn't enough on its own. Then end the sessions you don't recognize so nothing stays signed in behind you.

5. Check the bank side, not just Venmo

Look at your linked bank accounts and cards, your transfer history, and any pending transfers out. Check your balance and where recent payments went. Then check the bank account itself, since the linked account is the real target and its statement will show things Venmo's history won't.

6. Lock down what your account shows in public

Venmo transactions have historically defaulted to public, and a public feed is a map of who you pay, when, and for what. Set past and future transactions to private in your privacy settings, and turn off the setting that lets others see your friends list. This won't stop a login attempt, but it removes the material someone uses to make a scam message sound like it comes from someone you know.

Why your account was targeted

The password came from somewhere else. Attackers collect credentials leaked from unrelated breaches and replay them across payment apps in bulk, because a hit on a payment app pays better than a hit on a forum.

What turns a bulk attempt into a targeted one is context: a current phone number, an email address, a home city, the names of people close to you. Data brokers and people-search sites publish exactly that, compiled from public records and commercial sources and available to anyone willing to pay a small fee.

That context is what makes the call after the code work. Someone who can recite your address and a recent city you lived in sounds like a fraud department, not a stranger.

Delist finds those listings, files the opt-outs, and keeps re-checking them, because a removed profile frequently reappears. Run a free scan to see which sites are publishing your details.

The full pattern behind codes like this is covered in why you're suddenly getting 2FA codes you didn't request.

Frequently asked questions

Does this mean someone has my Venmo password?

Yes, most likely. The code is only sent after a password is accepted, so treat the password as compromised, and treat it as compromised anywhere else you used it.

Can they take money without the code?

Not through a fresh login. The risk is a session that's already signed in, or a transfer you're talked into approving yourself. Change the password, add a PIN, and sign out of unrecognized devices to close both.

I sent money after someone called about the code. Can I get it back?

Report it to Venmo and to your bank immediately. Peer-to-peer payments that you authorize are hard to reverse, which is why these scams focus on getting you to send rather than breaking in. File a report with the FTC as well.

Should I unlink my bank account?

Unlinking limits the damage from a future compromise, at the cost of convenience. A reasonable middle ground is to link a debit card or a low-balance account rather than your main checking account.

Why does Venmo keep texting me codes?

Someone is repeatedly attempting to sign in. Once you've changed the password the attempts stop working, though the texts may continue for a while as automated retries run through. If they persist, contact Venmo support through the app.