Unexpected code
Do not use or share a code you did not request. Review the linked account’s security.
Passwords, verification codes and recovery contacts serve different roles. Recognising warning signs and responding in order can help limit exposure.

A password is a secret used for authentication. Reusing it across sites allows one breach to affect other accounts. A unique long password and secure storage help reduce that exposure.
A one-time code relates to a particular request. An unsolicited code may indicate unusual activity. Do not send it to someone as proof for a support conversation.
Losing a recovery email or phone may require more than changing the main account password. Control of the linked contact method also matters. Verify the recipient before supplying information about an incident.
Consider these aspects separately according to your question.
Do not use or share a code you did not request. Review the linked account’s security.
Stop if someone requests money to a personal number to unlock an account. Independently verify through known support.
Record unfamiliar sessions or change alerts. End sessions and change credentials where controls are available.

After losing a phone, consider email, SIM and device security together. Revoke access from the lost device where that control exists. Then notify the relevant provider of the incident time.
Change exposed credentials from a trusted device. Explain the incident to support without supplying old or new passwords. Avoid sending full identity documents through ordinary email.
Leave suspicious messages or remote-access requests.
Secure email and credentials from a trusted device.
Contact genuine support with timing, symptoms and redacted evidence.
No. Do not disclose passwords or one-time codes.
It is a connection property, not proof of the site’s identity or claims.
Secure control of linked email, SIM and device access.
No. This site provides information and does not control operator accounts.