Why You Got a Text From 32665 (and Whether It Is Safe)

The short answer: 32665 is Facebook's official SMS shortcode. The digits spell FBOOK on a phone keypad. Messages from it are genuine Facebook texts — login codes, two-factor codes, password-reset codes and account alerts.

So a text from 32665 is normally nothing to worry about. What matters is why it arrived, and whether the message follows the one rule below.

The rule that tells you if it is real

A genuine Facebook SMS contains a short numeric code and nothing else. No links. No requests for your password. No threats to suspend your account. No attachments.

The shortcode itself proves nothing, because sender IDs can be spoofed. The content is what gives a fake away. If a message claiming to come from 32665 contains a link asking you to "verify" or "secure" your account, it is phishing regardless of what the sender line says — and you should not tap it.

Why it arrived when you did not ask for it

An unexpected code is worth two minutes of attention, because it usually means someone typed your details somewhere.

• Someone is trying to log into your account. The most common explanation. They have your email or phone number and possibly your password, and Facebook sent the second factor to you. As long as you do not share the code, they cannot get in.
• Someone mistyped their own number and yours received the code. Harmless, and surprisingly frequent.
• You triggered it — a login on a new device, a password change, or reactivating an account.
• A recycled number. If your number previously belonged to someone else, their old Facebook account may still be attached to it.

What to do about an unexpected code

1. Never share it. Not with a caller claiming to be Facebook support, not with a friend who "needs it to verify something", not with a buyer on Marketplace. Every legitimate use of that code is you typing it into Facebook yourself. Anyone asking for it is stealing the account.
2. Do not tap links in any message that contains one.
3. Change your password if codes keep arriving. Repeated codes mean someone has your email or number and is trying repeatedly.
4. Check active sessions — Settings & privacy → Settings → Password and security → Where you're logged in. Remove anything you do not recognise.
5. Turn on two-factor authentication if it is not on. An authenticator app is stronger than SMS, because it cannot be intercepted by a SIM-swap.

The Marketplace code scam

Worth naming, because it is aimed at exactly this shortcode. A "buyer" says they want to confirm you are a real seller and asks you to send them the code you are about to receive. What is actually happening: they are entering your phone number on a signup or reset screen, and the code they want is the one that hands them an account in your name.

There is no legitimate reason for another person to need a code sent to your phone. None.

Stopping the texts

If you simply want the SMS notifications to stop:

• Text STOP to 32665. This ends SMS notifications from Facebook. Texting START turns them back on.
• Turn them off in settings — Settings & privacy → Settings → Notifications → SMS.

One caution: stopping SMS also stops security codes arriving that way. If SMS is your only two-factor method, set up an authenticator app first, or you may lock yourself out.

Other codes you can text to it

Facebook's SMS service predates the modern app and still accepts a few commands. Texting OTP to 32665 returns a one-time password you can use to log in without your main password — useful on a device you do not trust. HELP returns the available commands.

These are legacy features and availability varies by country and carrier.

If you never had a Facebook account

Then someone is using your number to try to create or recover one. Ignore the codes and do not respond. Texting STOP will end them. Nothing can be created without the code, so as long as you keep it to yourself, no account exists in your name.

FAQs

Is 32665 the same in every country?

It is used in the US and several other countries, but Facebook uses different shortcodes in some regions. A different number is not automatically fake.

Can 32665 be spoofed?

Yes. Sender IDs are not authenticated, which is why the content of the message matters more than the number it came from.

Why do I get codes but never requested them?

Someone is entering your phone number or email on Facebook's login or reset screen. Change your password and enable two-factor authentication.

Does Facebook ever text a link?

Security codes never include one. Treat any link in a message from this shortcode as phishing.