Never Share Login Codes: Verification Code Scams Explained

The text lands on the internet director's phone at 11:40 a.m.: a six-digit Facebook login code. Ten seconds later, Messenger pings. The profile looks like a Marketplace buyer who was just asking about a Silverado. The message is polite: "Facebook sent you a code by mistake, I'm trying to log into my account, can you forward it?" A new associate, trying to be helpful, types the digits back. By lunch the store is locked out of the posting account, listings cannot be edited, and the "buyer" is gone.

That is a verification code scam, and it works because the request sounds like customer service, not theft. Never share login codes. The code is not a tracking number, not a listing ID, and not something Facebook needs you to read aloud to a stranger. It is the second half of the password.

This article explains how verification code scams work on a dealership floor, the scripts staff should use, and what to do in the first hour if a code already went out. It is operational guidance. Check Meta's current help pages for official account-security steps. PostToMarket is not affiliated with, endorsed by, or sponsored by Meta.

Why You Must Never Share Login Codes, Even With "Facebook Support"

Two-factor and login-approval codes exist so that a password alone is not enough. The moment you give the code to anyone who does not physically control that account for the store, you have completed their login. There is no benign reason a buyer, a shipper, a "Meta safety agent," or a vendor needs a code that arrived on a dealership phone.

What the code actually authorizes

Depending on the prompt, a code can:

• Approve a login from a new browser or phone.
• Complete a password reset.
• Confirm an email or phone change.
• Approve a sensitive setting change.

You cannot see, from the text message alone, which of those it is. Treat every unsolicited code as a live attempt to take the session.

Why dealerships are easy targets

Stores are high-volume Marketplace sellers. Staff are trained to answer fast, be helpful, and not lose a deal over "attitude." Scammers exploit that training:

• They open with a real-looking vehicle question, then pivot to the code.
• They impersonate Facebook or Instagram "support" after a fake policy notice.
• They time the ask for the Saturday rush, when a manager is on the lot and an associate is covering the inbox.
• They ask for the code "so I can buy the car on my other account."

Helpfulness is a sales skill. Forwarding a login code is not part of the job.

How Verification Code Scams Work on a Dealership Floor

The mechanics are consistent even when the story changes. Someone is already trying to log in as you, or has your password from reuse or phishing, and they need the one-time code to finish.

The "wrong code, please forward" story

The scammer triggers a login or reset so Facebook texts or emails your store phone or mailbox. They then claim the code was meant for them. It was not. Facebook does not accidentally deliver your account's code to a buyer. If a code arrived on the store device, it is for the store account.

The "support agent" story

A profile or email claiming to be Facebook support says the listing was reported, the account will be disabled, or a buyer filed a complaint. They need a code or a screenshot of the code to "verify you are the real seller." Real enforcement happens inside Facebook's own product and email domain, not via a Messenger request for digits. Related patterns are covered in Phishing Messages That Target Car Dealers on Facebook.

The "IT / GM asked me to grab it" story

Internal impersonation is uglier because it uses your org chart. A message from a look-alike email or a personal text: "I'm with the GM, send me the Facebook code, we are locked out of ads." Verify in person or on a known store extension. Never from the same chat that asked for the code.

The screenshot variant

If they cannot get you to type the digits, they ask for a photo of the lock screen or of the email. That is the same secret. Never share login codes, and never share photos of them either.

Floor Scripts That Stop the Handoff

Write these into the internet desk playbook. Associates should not have to invent a refusal while a "hot buyer" is waiting.

Script when a buyer asks for a code

"We never share login or verification codes with anyone, including buyers. If Facebook sent you a code, it belongs to your own login. I can keep helping you with the [year/make/model] from this chat or by appointment on the lot."

Then continue the vehicle conversation or end it. Do not debate how Facebook routing works.

Script when "support" asks for a code

"We do not give codes, passwords, or backup codes to anyone who contacts us. If this is a real Facebook notice, we will use the in-app or official help path from a bookmark, not from this message."

Do not click their link to "check." Open Facebook yourself from the app or a saved URL.

Script when a coworker asks via chat

"I cannot send codes over chat. If this is a real lockout, find me on the lot or call the store line and we will follow the recovery plan with a manager."

That pairs with An Account Recovery Plan to Build Before You Get Locked Out. Codes go to the custodian in person, not through Messenger.

Training that actually sticks

• New hires hear "never share login codes" on day one, next to "never share the safe combo."
• Post a one-line reminder at the internet desk: "Codes stay on this phone."
• Role-play the Silverado example in a five-minute huddle. People freeze less when they have already said no out loud.
• Make it clear that a lost deal is cheaper than a lost posting account. Managers must back the associate who refused.

Two-factor only helps if the second factor stays in house. Setup guidance: Two-Factor Authentication for Dealership Facebook Accounts.

If a Code Was Already Shared: Lock-Down Steps

Assume the other party completed login until you prove otherwise. Speed matters more than blame.

1. From a known-good store device, change the Facebook password. Do not do this from a link in the chat that requested the code.
2. Review logged-in sessions and devices. Sign out anything you do not recognize.
3. Confirm the recovery email and phone still match the store-controlled mailbox and SIM. If they changed, you are in a full recovery situation, not a simple password rotation.
4. Rotate mailbox credentials if that inbox received the code or a reset mail. See Securing the Email Behind Your Dealership Facebook Account.
5. Check two-factor settings. If an attacker added their own method, remove it and restore a store-controlled authenticator or phone. Print new backup codes and store them with the recovery plan.
6. Scan live listings for price changes, contact bait, or units you did not post. Take down anything that is not yours.
7. Pause posting until a manager confirms the account is back under store control. Do not "test" with a burst of vehicles.
8. Record the incident: time, which code prompt appeared, which staff member was contacted, what was shared, and what you changed. Use it in the next huddle.

After access is stable

• Tell staff the account is in a freeze: no new devices, no password sharing, no "help the buyer with their login."
• Watch the recovery mailbox for further reset attempts.
• If you cannot get back in, follow your recovery plan and Facebook's official recovery flows. Do not hire a stranger in Messenger who offers to "restore admin."

What not to do

• Do not send a second code to "see if it was a mistake."
• Do not argue with the scammer or try to reverse-scam them.
• Do not keep using a device you cannot account for.
• Do not punish the associate in a way that teaches the next person to hide a mistake. You need the report immediately.

How PostToMarket Automates This

Verification code scams succeed when every rep sits inside the same Facebook login and thinks "helping with a code" is part of covering the inbox. PostToMarket moves posting work into per-person queues so staff can sell cars without holding the keys to the account's second factor.

Posting without sharing the Facebook login

• Roles (admin, manager, sales rep, sales associate) separate who runs the team from who works a queue.
• Managers assign vehicles to associate queues; sales reps self-queue from shared inventory. Nobody needs the Facebook password to receive work.
• Team queue view lets a manager release a claim if the assigned person is out, without handing over login codes.

A place for the conversation besides "just log in as us"

• Leads inbox for managers so Marketplace conversations are visible as store work, not as a private chat on one phone that also receives 2FA texts.
• Inventory statuses (draft, posting, posted, sold, failed) so the desk can see what is live without passing around sessions.

Resume posting without a panic batch

• The Chrome extension submits one vehicle at a time with human-like delays.
• Server-enforced daily post limits and delays keep the "we got the account back" afternoon from looking automated.
• Mark as sold and archive from inventory or the queue if anything sold while you were locked down.

The product does not replace two-factor, and it cannot keep a code secret if someone types it into Messenger. It does remove the operational reason associates are sitting on the same login that receives those codes.

Put "Never Share Login Codes" on the Same List as the Safe Combo

Verification code scams explained in one line: if the digits arrived on a store phone, they are for the store, and they never leave that phone. Script the refusal, back the associate who uses it, and run the lock-down steps the same day if a code already leaked.

While you tighten that habit, put inventory and queues somewhere that does not require sharing Facebook credentials across the floor. PostToMarket Starter is $59 per month for a solo seller or independent lot with one login. Dealership is $299 per month for up to 13 team logins. Both open with a 10-day free trial and secure Stripe checkout. Cancel anytime.

Start your 10-day free trial and give associates a queue instead of a login code. Questions: info@posttomarket.com.