Where does the 23837 text message come from?

23837 is Afterpay’s official short code.

It’s used for verification codes, account notifications, and two-factor authentication.

The code itself is legitimate—but scammers can spoof it. If a message includes a clickable link, pressures you to act fast, or asks for personal info, it’s not from Afterpay.

Who owns the short code 23837?

• Registered to Afterpay (Block, Inc.)
• Industry: Financial Technology (Buy Now, Pay Later)
• Active in the United States, Canada, and Australia
• Used for customer support and automated notifications

This checks out across multiple independent sources. Afterpay’s official help center acknowledges receiving reports about texts from this number. The University of Tennessee’s cybersecurity team independently identifies 23837 as Afterpay’s customer support number used for sending six-digit verification codes.

Reddit users regularly confirm they receive verification codes from this exact number—and it’s consistently tied to Afterpay’s authentication system.

Why you got a text from 23837

• 2FA codes—someone logged in to (or tried to log in to) an Afterpay account tied to your number
• Password resets—a reset request was triggered for an account linked to your phone number
• Account creation—someone used your number while signing up for Afterpay
• Transaction confirmations—purchase notifications or payment reminders for installments
• Account alerts—unusual activity or important updates about an existing account

2FA codes are the most common reason people search for this number. If you didn’t initiate a login, someone likely entered your number by mistake—or is actively trying to break in.

Transaction and payment messages are informational only—no action required.

Is the 23837 short code safe or a scam?

In short: 23837 is Afterpay’s real short code. But scammers target it heavily—either by spoofing the number or triggering actual codes to hijack your account. If you get an unexpected code from this number, treat it as a red flag.

Threat level: HIGH

• Verification code you requested → safe, standard communication
• Verification code you didn’t request → suspicious, don’t share it
• You’re not an Afterpay customer → likely harmless, wrong number or recycled number
• Message contains a clickable link → scam.

The short code is legitimate. The concern is what’s inside the message

A standard Afterpay code contains nothing but a six-digit number—no links, no urgency, no requests to reply. But when you receive an unexpected code, it means someone typed your phone number into a login form—and that code is the last thing stopping them from getting in. Could be a typo. Could be an account takeover attempt. Don’t share it either way.

If you don’t have Afterpay at all, another customer probably mistyped their number during signup, or your number was previously assigned to an Afterpay subscriber who never updated their info. Multiple Reddit users report exactly this.

If the message contains a clickable link, it’s a scam. Legitimate Afterpay verification codes never include URLs.

Why non-customers receive texts from 23837

• Wrong number entry—an Afterpay customer mistyped their phone number during login or signup
• Recycled phone number—your carrier reassigned a number that was previously tied to an Afterpay account.

The first scenario is far more common. Users consistently express confusion about receiving codes for accounts they never created.

Afterpay’s help center acknowledges the recycled number issue directly: “Mobile phone numbers do get recycled, so you could have received a number that was previously linked to an Afterpay account.”

Neither scenario means your identity has been stolen.

How to spot a 23837 phishing scam

Feature	Legitimate Afterpay message	Phishing attempt
Links	No links—just a 6-digit code	Contains URLs (e.g., bit.ly/random, afterpay-verify.com)
Requests	No reply or callback needed	“Verify now” or “call this number”
Tone	Neutral, no urgency	Urgent, threatening account lockout
Spelling	Clean, professional	Grammar errors, odd formatting

The University of Tennessee’s cybersecurity alert warns that scammers actively spoof the 23837 number: “The number used in the message is actually Afterpay’s customer support number and the text sender’s number is 23837, but it is likely the sender is spoofing that number.”

Safe Not Scammed documents detailed analysis of these tactics, showing how fraudulent messages mimic legitimate formatting while embedding malicious URLs.

How these scams actually work

The attack typically unfolds in stages. 

First, criminals obtain login credentials through data breaches, phishing emails, or credential stuffing. They then attempt to log in to your Afterpay account—which triggers a real verification code from the legitimate 23837 number.

Here’s where it gets tricky: the code arrives from Afterpay’s actual short code because the scammer initiated a real login attempt. They’re hoping you’ll either ignore it or—worse—share the code if they call pretending to be Afterpay support.

In more sophisticated attacks, scammers spoof 23837 entirely and send texts containing phishing links. The message looks like it belongs in the same thread as your legitimate Afterpay codes.

What to do if you receive a suspicious text

If you’re an Afterpay customer:

1) Start by checking your account directly. Log in to the official Afterpay app—don’t use any links from the text.

2) Change your password immediately. Use something unique that you don’t use anywhere else.

3) Enable biometric authentication if your device supports it. Fingerprint or face recognition adds a layer that can’t be stolen in a data breach.

4) Review your account activity for purchases or changes you didn’t authorize. Check transaction history, saved payment methods, and account details.

5) Check for data breaches at haveibeenpwned.com to see if your email appears in known breaches. If it does, change passwords on any accounts where you used the same credentials.

The most important thing? Never use a link from the text itself. If the message mentions account activity, verify it through the app.

If you’re not an Afterpay customer:

1) Whatever you do, don’t click any links—even if you’re curious.

2) If someone asks for a verification code and claims it was sent “by accident,” don’t share it.

3) You can safely ignore and delete the message. The code expires within minutes.

4) If the messages persist, block 23837—though this prevents future Afterpay use if you later sign up.

If someone contacts you asking for a code they say was “accidentally” sent to your number, refuse. This is a common tactic where scammers use your phone number to verify accounts they’re trying to break into.

How to report suspicious messages

• Forward to 7726 (SPAM)—works across most US carriers
• Report to Afterpay—contact their official support through the app or website, never through contact info in a suspicious text
• File with the FTC—at reportfraud.ftc.gov for phishing attempts requesting payment or personal info

Forwarding to 7726 is especially useful if the message spoofs Afterpay’s branding—your carrier will investigate.

Afterpay’s official guidance states: “If you have received a [sic] SMS verification or email message from Afterpay that you have not triggered, you can safely ignore this.” 

But they emphasize you should never click links or share codes.

FAQ