A common vishing tactic: a caller claims to be your bank or the college, says there’s a security issue, and asks you to ‘verify’ by reading back a one-time passcode that was just texted to you. That code is meant for you alone — never read it to anyone.