Should you ever read a one-time verification code to someone who calls you?
No. A one-time passcode is meant only for you. Anyone — even someone claiming to be from your bank — who calls and asks you to read back a code is trying to take over your account.
What it is
A scammer who already has your username or card tries to log in, which triggers a real one-time code to your phone — then calls you pretending to be your institution to trick you into reading it back.
How to spot it
You get a login or verification code you didn't request.
Right after, someone calls or texts asking you to share it.
The caller claims they need the code to "verify" or "protect" you.
There's pressure to read it back quickly.
What to do
Never share a one-time code with anyone. Your credit union will never ask for it — if you get an unexpected code, change your password and call your institution directly.
When in doubt, slow down. A real credit union, business, or agency is fine with you hanging up and calling back on a number you look up yourself.