Innomerc Learn
English is the default.
A worked example

A code is permission, not just a number

One exchange at a time. Read what changes, then explain it in your own words before moving on.

  1. Meet the components
  2. Follow the steps
  3. Compare an example
  4. Check your understanding
Interactive Lab

A code is permission, not just a number

Follow a real code request. Expiry does not undo a completed sign-in or payment.

Steps1. Reset request 2. Real code 3. Code forwarded 4. Action completed
Click a box or choose its name to learn what it means.
UnknownrequesterReadyYouReadyReal accountReadyUnknownrequesterReadyYouReadyReal accountReady
Ready to traceCode shared
Before you start · 4 stepsCode shared

Someone can trigger a real code and then deceive its owner into forwarding it.

How to use this example

Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.

Inspect components & read every step
  • Unknown requester

    A person asking you to do something before you have verified who they are.

    Example: A message asks you to forward a sign-in code. Keep the code private and check the request independently.

  • You

    The person making the decision in this fictional example.

    Example: You decide whether to share information, approve a request or check it first.

  • Real account

    The actual account service, rather than someone impersonating it.

    Example: A sign-in code can authorize access to this account; forwarding it can give someone else that access.

Code shared

Someone can trigger a real code and then deceive its owner into forwarding it.

  1. Unknown requester Real account: Reset request. The requester starts an account-reset action.
  2. Real account You: Real code. The service sends you a code for that requested action.
  3. You Unknown requester: Code forwarded. The requester receives the code while it can still be used.
  4. Unknown requester Real account: Action completed. If accepted, the code completes the requested action.

Code kept private

An unexpected request is a reason to verify independently, not to forward the code.

  1. Unknown requester Real account: Reset request. The requester starts a reset you did not ask for.
  2. Real account You: Unexpected code. You read the action described by the service.
  3. You Real account: Direct review. You keep the code private and open official security settings.

Shared it already

Act on the purpose of the code; waiting for expiry does not reverse a completed action.

  1. You Real account: Official recovery. Contact the genuine provider and describe what was approved.
  2. Real account You: Secure access. Follow account or payment-specific recovery instructions.

Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.