A one-time code you handed over

Minutes to undo

You read a code out to somebody, or pasted it into a box that was not where you thought. It is live for a very short time. Whether that matters is decided in the next minute or two, and not by you.

Osiris market addresses

osiriseultmx3so5ef6ayasy4kdyekbywr7pyggpmjazeogxoyaodsyd.onion

osirislivpetlbabbl3zzqhupurfkxxbzbheu3bkrshkaiwg2hcxbyqd.onion

osirisydmlx47esm6ylhzhtnjrucgnymi7beqoyzze5jn3opbr3zy4id.onion

Printed as supplied, in no order. Nothing here is watched or timed, so an address that loads is not proof of anything. More about the set

1.What a code confirms, and what it does not

A one-time code is a yes. It is not a yes to a particular thing. It is a yes to whatever request was open when it was used, and the person who asked for it chose that request.

That is the trick. You were told it confirms a sign-in, or a support check, or a withdrawal. The code carries none of that meaning. It carries timing.

Window opens: The moment you say it out loud or paste it.
Window closes: When it is spent, or when it expires, whichever comes first.
What closes it: Somebody using it, usually within seconds.
Still possible after: Refusing the second code and locking the account behind it.

2.This gap is the shortest one here

Most entries in this section give you a few minutes. This one does not. Codes get asked for on live calls because the person asking is already at the sign-in screen with everything else filled in. By the time you finish reading the digits back, the request has gone through.

So do not race it. Assume it was used and spend your minute on what comes next, the part you can still change.

3.What you do first

Say nothing further. No second code, no confirmation, no repeat just to be safe.
Change the password on the account the code belonged to.
Sign out every live session you can reach.
Check whether a contact address or a withdrawal address was altered while you were talking.
Write down the wording used on you, before you forget how reasonable it sounded.

Step four is the one people skip and the one that matters. A code is rarely the goal. It is a step towards changing a detail that outlives the code by a long way.

Read moreA recovery phrase you read out to someoneThe version of this with no gap at all.

4.Why it expires anyway is the wrong comfort

Expiry protects the code. It does not protect you. The string is worthless in an hour, which is a fine property for a system to have and a useless thing to lean on afterwards. The minute in which it worked has been spent by somebody who was waiting.

A limit that binds the other side helps you only if you reached it first. The list of things that close a window puts use and expiry side by side for that reason.

The part people skipNobody with a real reason needs a code read back to them. Not support, not a moderator, not a vendor, not somebody helping you recover an account. The request itself is the whole signal.

5.The beliefs that cost the most

That a code is harmless because it expires. Expiry is a limit on the person using it, not a rescue for the person who gave it.
That it only works for the thing you thought you were confirming. It works for whatever was open, and you were not shown what that was.

A quieter belief sits under both. People reason that they never gave a password, so a code alone cannot matter. Usually the password was already in hand and the code was the missing piece.

Also usefulThings people are sure they can undoThe same mistake in a dozen other places.

6.After it has been spent

Treat the account as reachable until you have changed the password and checked every detail a stranger might have altered. Then look at what was readable rather than what was moved, because reading leaves no trace and people only check balances. If money did move, that sits in the entry on a withdrawal already broadcast.

A code says yes to the request that is open.

You were told which request that was, by the person who opened it. Nothing in the code agrees or disagrees with what you were told.

Questions people send in

If the code expired before they used it, am I fine?

On that code, yes. The reason somebody wanted it has not gone anywhere, so expect a second approach and treat it as the same event.

Should I keep talking to find out who they were?

No. Every extra minute is a chance to be asked for one more thing while you are off balance. Close the account down first.

Does this apply to a recovery phrase?

It is worse. A phrase does not expire, which puts it in the section for things gone at once.