Never share your 6-digit code with someone who contacted you. Not over the phone, not by text, not by email, not even if the person sounds exactly like someone from First Commonwealth.It sounds simple, and it is. But this one step stops one of the most common ways scammers get into accounts today. Here's how the scam works, what it sounds like, and what to do if it already happened to you.
What the code is for
When you log in to online banking, sign in from a new device, or make certain account changes, we send a short code to your phone or email. You enter it, and we know it's really you.That code is a second lock on your account. Your password is the first. Together, they make it much harder for someone else to get in, even if they've managed to steal your password.The code only works because you're the only one who sees it. The moment you read it to someone else, that second lock is gone.
How the scam works
Scammers want that code because it's the one thing they can't get on their own. Here's what usually happens:
- They first get some of your information. That might be your name, phone number, email, or a password leaked in a data breach somewhere else.
- They try to log in to your account. That triggers a real code from us, sent to your phone or email.
- They contact you at the same time. A call, text, or email, often claiming to be from your credit union's fraud team.
- They ask you to read back the code. They'll say it's to verify your identity, stop a suspicious charge, or cancel a transaction.
- They use it to get in. Once inside, they can change your contact info, lock you out, and move your money.
The whole thing can take a few minutes. And because the code you received is real, the call can feel real too.
They won't always call it the same thing
Scammers know you've been warned about sharing a "code," so they change the wording. You might hear:
- Secure Access Code
- Verification code
- Authorization code
- One-time passcode
- PIN or security number
- "The number we just texted you"
Different names. Same code. If someone who reached out to you asks you to read back any number that just arrived on your phone or in your inbox, don't share it.
Who started the conversation matters
This is the single most useful question you can ask yourself: did I reach out, or did they?
If you called us at a number you know is ours, we'll ask you to verify your identity. That's us protecting your account, and it's expected.
If someone calls, texts, or emails you first and asks for a code, hang up or stop replying. Even if the caller ID says First Commonwealth. Even if they know your name, your address, or the last four digits of your card. Scammers can easily find or fake that information, and caller ID can be made to show any name or number.
Then call us yourself at 888.821.2400 or the number on the back of your card. If the original call was real, we can pick up right where it left off. If it wasn't, you just stopped a scam.
Signs you're talking to a scammer
These calls are designed to make you act fast. Watch for:
- Urgency. "We need to stop this charge right now" or "Your account will be locked in 10 minutes."
- A code arriving mid-conversation. If a code shows up while someone is on the phone with you, that's them trying to log in.
- Requests to stay on the line. They don't want you to hang up and call back.
- Pressure to keep it quiet. "Don't tell the financial center, they're part of the investigation."
- Requests to move money to a "safe" account to protect it.
Any one of these is reason enough to hang up and call us directly.
Already shared a code?
Call us right away at 888.821.2400. The sooner we know, the more we can do.While you're at it:
- Change your online banking password.
- Check your recent transactions and account details, including the email and phone number we have on file.
- Change the password on any other account that uses the same one.
This happens to careful people every day. Scammers are good at what they do, and calling us quickly matters far more than how it happened.
One rule to remember
If you didn't start the conversation, the code stays with you. Hang up, call the number you know, and let us sort out the rest.For more ways to spot and stop scams, visit our Fraud Center.