Messenger users should note that:

• Legitimate CMA support services will not request verification codes within the application.
• CMA support services do not send users links to “verify” or “restore” accounts.
• They should never provide a verification code without confirming the request comes from a legitimate CMA communication channel.
  As always, it’s a good idea to resist taking on the feeling of urgency that’s often conveyed in such messages. There is rarely a penalty for waiting an extra hour or two to act, even when responding to legitimate requests.

CMA = commercial messaging application