That happened to me once. I declined to provide the code. Might have been legit but seemed too big a risk of getting my phone number tied to something scammy or even criminal.