Verified sender Published Aug 20, 2026

Is 28581 a real Cash App code or a scam?

Bewary fraud research, published by Andrey Khayrullaev, founder. How we research scam patterns.

Example text from 28581

Cash App: 123-456 is your sign-in code. Do not share it with anyone. Cash App will never ask for this code. That is the normal shape, short, code-first, no login link, no phone number to call, no threat about a charge. The danger starts when someone else caused that code to be sent, then contacts you and says reading it back will cancel fraud or verify your identity.

REAL

28581 is Cash App. Real code. The structural tell is the job of the message, a real 28581 text delivers a one-time Cash App code or account alert and stops there. The scam usually sits around the real text, with a caller, fake support chat, link, or callback number trying to make you hand over the code.

Operated byBlock, Inc. (Cash App)

What real messages from 28581 do

Send Cash App sign-in verification codes. The real text is built around the numeric code, because that code completes a login or account-access step inside Cash App.
Confirm account access during a sign-in attempt or device change. If you just opened Cash App, changed phones, or tried to log in, a 28581 code can be ordinary.
Send security language tied to Cash App account protection. Real messages do not need you to leave the app, call a number in the text, or move money to prove you own the account.
Send account or payment notifications tied to Cash App activity. A genuine alert may tell you something happened, but it will not ask you to send a fee, refund yourself, or pay a stranger to unlock anything.
Support the SquareCash short-code campaign leased by Block, Inc. The code can be genuine while the person coaching you on the phone is the criminal.
Respond as a normal short-code sender when users use standard text controls such as HELP or STOP. That does not make every message with Cash App words real, because scammers often copy the wording from ordinary mobile numbers.

How a fake 28581 differs

The message contains a login link. Real 28581 code texts do not need a web page. Scam links often use shapes like cashapp-login[.]com, cash-app-verify[.]net, or squarecash-secure[.]com, close enough to look familiar while sending the code to the attacker.
A caller asks for the 28581 code right after it arrives. That is the takeover play. The attacker starts a real Cash App sign-in using your phone number, Cash App sends the real code, then the attacker claims the code is needed to cancel the sign-in.
The sender is not 28581. Many copycat texts come from a ten-digit mobile number, an email-to-text address, or a group thread, then paste Cash App language into the body. A body that says Cash App does not turn a random sender into Cash App.
The text says to call about a pending charge, locked balance, refund case, or withdrawal you did not make. The callback number is the trap. Once you call, the fake agent keeps you talking until a real Cash App code arrives and asks you to read it aloud.
The message adds a panic clock. Lines like 'confirm in 10 minutes' or 'avoid a $499 transfer' are designed to stop you opening Cash App yourself. One-time codes are for account access, not for proving innocence to a stranger.
The conversation asks for the Cash App PIN after the code. A code plus PIN is enough to do real damage. Fraud callers often ask for both while pretending each piece is only for verification.
A fake support account on Instagram, X, Facebook, or a search-ad landing page tells you to screenshot the 28581 text. Screenshots leak the same secret as reading the code aloud. Real support does not need a picture of a live sign-in code to look at a payment issue.
You did not request a code, but someone immediately contacts you with a story that explains it. That sequence is the tell. The code did not prove a case exists, it proves someone is trying to start a Cash App login with your phone number.

What to do now

Do not read the 28581 code to anyone. Do not paste it into chat. Do not send a screenshot. If a caller says the code cancels fraud, hang up, because the code gives account access.
Open Cash App from the app icon, not from a text link. Check Activity for payments or Cash Card charges you do not recognize. Check your profile details for changed phone or email information.
If you did not request the code and no money moved, take a screenshot for your records, then ignore the code. Block the caller or social account that tried to explain it. The code will expire, but the scammer may try again.
If you shared the code or see account changes, contact Cash App directly. Use Cash App Support inside the app, type cash.app/help into your browser, or call 1-800-969-1940. Do not use any number sent by text or found in a sponsored search result.
Lock down the Cash App account from inside the app. Change your Cash App PIN, turn on Security Lock with Face ID, Touch ID, or a passcode, and review linked cards, linked banks, and Cash Card status.
Report the incident to Cash App through the same official support path. Give the screenshot, the time the 28581 code arrived, the caller number or social handle, the $Cashtag involved, and any payment IDs from Activity.

Got a text you are unsure about?

Paste it here. Bewary reads it and tells you straight, free.

Sources

What this page checks against.