A person offering visa help in a messaging group may ask for a passport scan, then a verification code, then access to your screen. Each request deserves a separate decision. Agreeing to discuss an application does not mean agreeing to surrender control of your email, bank account or device.
Identify the request before answering
Ask which organisation needs the information, what application step it supports and where that requirement appears in the official process. Check those details through a contact route you find independently. A WhatsApp or Telegram profile name is not an identity check.
Legitimate applications can require passport copies. The question is whether this particular recipient and channel have been verified. Avoid placing an identity document in a group chat or forwarding a complete family file simply because a stranger offers to assess eligibility. Keep a private note of what you supplied and to whom.
A login code is a key
The US Federal Trade Commission explains that a verification code can help protect an account, but a scammer who obtains it may use it to sign in. Do not read an account-login code to an unexpected caller or paste it into a chat with someone claiming to fix a visa problem.
Check the message describing the code. Which account or action does it concern? If you did not initiate that action through a verified service, stop. Receiving a real message from your bank or email provider does not authenticate the person asking you to share its contents.
Do not hand over your screen
Australia's cyber security agency warns against giving strangers remote access. An offer to complete a difficult application is not sufficient reason to let an unknown person operate your device, inspect saved files or watch you sign in to financial accounts.
As a practical alternative, ask for written instructions that you can compare with the official guidance and follow yourself. If you need hands-on help, choose a person or service whose identity and role you have checked first.
Act on exposure, even if no money moved
If someone gained remote access, disconnect the device from the internet and obtain trusted technical help. From a safe device, secure affected accounts and contact your bank if financial access may have been exposed. New Zealand's NCSC guidance recommends changing compromised passwords and disconnecting unfamiliar account sessions where available.
If a passport has been used without permission, report that to its issuing authority. If only a copy was exposed, ask the authority what precautions apply rather than assuming you must cancel the passport. Preserve the messages and use the platform's reporting tools.
Official sources
- FTC: verification codes and account impersonation
- Australian Cyber Security Centre: remote access scams
- New Zealand NCSC Own Your Online: incident response and identity documents
Sources reviewed on 23 Oct 2026. Requirements can change and depend on your nationality and circumstances. This article is general information, not a personal eligibility assessment.
