Keep access information private

A Security Explanation Does Not Justify a Code Request

A request for a password or verification code can be disguised as a protective step. Pause when an unexpected sender asks you to disclose information used to establish access.

Independent guideTeamjieletric is an independent educational publisher. It is not affiliated with, endorsed by, or acting on behalf of TIAA. We do not verify messages, investigate incidents, recover accounts or provide technical support.

Know what the request is asking you to disclose

Credentials are information used to establish access, such as a username and password. Recovery information and security codes can also play a role in access checks. A sender may call the same information a confirmation, a reference or a safety check. The label does not change what you are being asked to reveal.

A code that arrives on your own device should not be read aloud or forwarded to an unknown person. Receiving it yourself does not make a separate caller or message trustworthy. Treat the code as private and use an independently confirmed source if its arrival concerns you.

Recognize a request framed as protection

An unexpected contact may first describe a threat and then present disclosure as the solution. This can reverse the normal meaning of a security step: you are being asked to give information away in order to feel protected. The urgent explanation should not override your decision to check separately.

The request may arrive by email, text, phone or a web page opened from a message. A move to another channel is not independent verification when the original sender arranged it. A second speaker, new link or follow-up text can remain part of the same unconfirmed exchange.

  • Do not disclose a password in a reply or during an unexpected call.
  • Do not forward or read out a verification code to an unknown sender.
  • Do not share recovery information as a supposed identity test.
  • Do not approve an unexpected request because a caller tells you to.
  • Do not provide any of these details to Teamjieletric.

Use the right kind of independent check

Stop interacting with the original communication. Locate an established app, trusted bookmark or confirmed official contact source yourself. Do not use a number or link supplied inside the request as the evidence that the request is legitimate.

Through that confirmed route, follow the organization's current guidance for your situation. This site does not describe TIAA's complete authentication procedures and cannot decide which steps apply to a particular account. General education should not be mistaken for a brand-specific support instruction.

If information may already have been disclosed

Use a confirmed official channel promptly and follow its instructions. Avoid returning to the person who requested the information to ask for reassurance. You do not need to send us the code, a password, a screenshot or a description of the incident to use this guide.

Teamjieletric cannot recover access, assist with authentication, unlock an account or investigate disclosure. Our editorial form is for general questions and corrections about published content. Sensitive access information and individual incident details do not belong in that form.

Keep this in mind

Keep the information private, leave the unexpected exchange and confirm through a separate source.

A person adjusting a shoe beside a wood-paneled wall
Illustrative photograph; no person pictured is identified as a staff member or an incident subject.

Related reading

Source Reference

Sources reviewed November 4, 2026. External references are informational, with no referral tracking or partnership implied. Confirm current instructions at the source.