Picture this: you get a text with a six-digit code you never requested. A minute later, another. By evening your WhatsApp has logged you out, your Instagram password has changed, and a friend messages to say you just asked them for ₦50,000. Nobody "hacked" you in the movie sense. Someone simply used the "Forgot password" button, and your phone number or email did the rest.
That is the core idea of this guide. Your email address and phone number are the master keys to almost everything: bank apps, fintech wallets, exchanges, social media, freelance platforms. If a scammer controls either one, they can reset the others. So the job is to protect the keys, not just each account.
How scammers use "forgot password" against you
Most account takeovers follow the same pattern. The attacker knows your phone number or email (easy; it is on your CV, your business page, your WhatsApp profile). They start a password reset on the target app. The app sends a code or link to you. Then the attacker needs one of three things:
- You to hand over the code. They call or message pretending to be your bank, a delivery rider, a platform "verification team" or a friend who "sent the code to the wrong number".
- Control of your SIM. If they convince a network agent to move your number to a new SIM, the codes arrive on their phone. Your phone suddenly shows "No service".
- Access to your email inbox. If your email password is weak or reused, they read the reset links directly.
Notice that none of these require advanced skills. They rely on weak passwords, reused passwords and your willingness to be helpful or afraid. That is good news, because you can close each door yourself.
Step 1: Lock down your email first
Your email is more important than your phone number, because nearly every reset link ends up there. Do these in order:
- Set a long, unique password. Use a passphrase of four or five unrelated words, or let a password manager generate one. Never reuse it anywhere else.
- Turn on two-step verification (also called two-factor authentication) in your email account settings.
- Prefer an authenticator app or a passkey over SMS codes. Text-message codes can be diverted by a SIM swap; app-based codes live on your phone and cannot be redirected that way.
- Save backup codes. Your email provider can give you a set of one-time codes. Write them on paper and keep them at home, not in a screenshot in your gallery.
- Check your recovery options. Look at the recovery phone number and recovery email listed on the account. Remove anything old, such as a number you no longer own or an email you never check.
- Review signed-in devices. Sign out of any device or location you do not recognise, then change the password.
- Check for forwarding rules. Attackers sometimes set your inbox to quietly forward copies of mail to them. Look in your email settings for forwarding and filters you did not create.
Consider a dedicated email address for money accounts (bank, fintech, exchange) that you never use for newsletters, job applications or public profiles. If scammers cannot guess or find that address, they cannot easily target it.
Step 2: Protect your phone number
In Nigeria, Ghana, Kenya and South Africa, your phone number is tied to your bank, your mobile wallet and often your identity records. That makes it valuable.
Reduce who can see it
- Do not post your personal number on public Facebook pages or open groups. Use a separate business line for customers.
- In WhatsApp privacy settings, limit who can see your profile photo, "about" and last seen to contacts.
- On Telegram, hide your phone number from people who are not saved contacts.
Add a PIN with your network and your messaging apps
- Turn on two-step verification in WhatsApp and Telegram. This adds a PIN that is asked for separately from the SMS code, so a stolen code alone is not enough.
- Ask your network provider what extra protection exists on your line against unauthorised SIM replacement. Options and procedures differ by network and country, so ask at an official service centre or through the provider's verified channels.
Know the SIM swap warning signs
Sudden loss of signal when others around you still have service, a flood of unexpected verification codes, or alerts about logins you did not make are all warning signs. If this happens, use another phone or Wi-Fi to contact your network and bank immediately and ask them to block the line and freeze your accounts. Do not wait until morning.
Step 3: Never share codes, and learn the scripts
A one-time code is a password with a two-minute life. Nobody legitimate needs it from you. Not your bank, not a platform's support team, not a friend.
Common scripts include:
- "Sorry, I mistakenly sent my code to your number. Please forward it." The code is actually yours, from a reset the scammer started on your account.
- "This is your bank's fraud desk. To cancel the suspicious transaction, read us the code we just sent." Real banks do not ask for OTPs, PINs or full card details by phone.
- "Your account will be suspended in 24 hours unless you verify." Urgency is the tell. Hang up and call the number printed on your card or the official app.
- A "buyer" on a marketplace who wants you to confirm with a code sent to your phone before paying.
The rule is simple: if you did not start the action, do not give the code. If you did start it, give the code only to the app or website you typed in yourself. For more on how insiders and callers get around customers, see our post on bank insider fraud and guarding your account.
Step 4: Fix the weak links in your other accounts
Once email and phone are safer, rank your other accounts by damage potential:
| Priority | Account type | What to do |
|---|---|---|
| 1 | Bank and fintech apps | Unique password, app PIN, biometric lock, transaction alerts on, transfer limits set low |
| 2 | Crypto exchanges and wallets | Authenticator app, withdrawal address allow-list if offered, offline copy of recovery phrase |
| 3 | Freelance and payout platforms | Authenticator app, check payout details regularly |
| 4 | WhatsApp, Instagram, Facebook | Two-step verification, review linked devices |
| 5 | Shopping, streaming, newsletters | Unique password at minimum |
If you hold crypto, practise recovering your wallet before you need to; our wallet recovery drill shows how to test a backup with a tiny amount.
A worked example (hypothetical)
Ada runs a small online shop in Enugu. Her number is on her Instagram page, her Gmail-style email is the same one she used for her bank app, her fintech wallet and her Instagram. Her password is her shop name plus her birth year, used in all four places.
A scammer finds her number, tries a reset on her Instagram, and sends her a message: "I sent my code to your number by mistake, please send it." Ada, trying to be polite, forwards it. Within an hour her Instagram is gone and customers are being asked to pay into another account.
Here is how the fixes above would have changed that outcome:
- A separate email for banking means the Instagram breach does not give access to money accounts.
- A unique password means a leak from one site cannot open the others.
- An authenticator app on Instagram would have demanded a second factor the scammer did not have.
- A business number on the page, with her personal number kept private, would have made the targeting harder in the first place.
The total cost of these fixes is about an hour of her time and nothing in cash.
Common mistakes to avoid
- Screenshotting backup codes or recovery phrases. If someone gets into your photos or cloud storage, they have everything.
- Using your NIN, birthday or phone number as a password. These are easy to find or guess.
- Keeping old recovery numbers. Networks can recycle numbers that go unused. A recovery number you abandoned may one day belong to a stranger.
- Clicking links in "security alert" messages. Open the app directly, or type the address yourself. Fake sites copy real ones closely; see our guide to confirming an official site.
- Letting someone "help" at a phone shop. Never let a stranger handle your phone while you are logged into email, bank or wallet apps.
- Relying on SMS codes only. They are better than nothing, but they are the weakest second factor.
If you think you have been locked out or taken over
- Use a second device and change your email password first, then sign out all sessions.
- Call your bank using the number on your card or the official website. Ask for a temporary block on transfers and cards.
- Contact your network provider if you suspect a SIM swap, and ask for the line to be secured.
- Use each platform's official recovery process for hacked social accounts. Ignore anyone in comments or DMs offering to "recover" it for a fee; that is often a second scam.
- Warn your contacts from another account that messages asking for money may not be from you.
- Keep evidence: screenshots of messages, transaction references, times. You will need them for your bank and for any official report.
- Report it. Your bank's fraud channel comes first; then the relevant authorities in your country.
Frequently asked questions
Is a password manager safe to use?
For most people it is safer than memorising a few passwords and reusing them. Protect the manager itself with a strong passphrase and two-step verification, and keep the recovery details on paper.
Should I stop using SMS codes completely?
Not if SMS is the only option. Use it where nothing better is offered, and switch to an authenticator app or passkey wherever the service supports it, especially for email, banking and crypto.
Can I use one phone number for everything?
You can, but splitting is safer. Keep one number private for banking and account recovery, and a second for public, business and social use.
What if a caller already knows my name and bank?
That means nothing. Names, banks and even partial account numbers leak from many sources. End the call and dial your bank yourself.
Your next step today
Open your email account settings right now. Set a new unique password, turn on two-step verification with an authenticator app, and delete any recovery number or address you no longer use. Then do the same for your bank app. That single twenty-minute session closes the door most account takeovers walk through.
This article is for general information only and is not financial, legal, or tax advice. Prices, rates and rules change quickly, so check current details before making money decisions.