Here’s how scammers try to phish for verification codes — and what may happen if you send them one.