Why Payout and Email Changes Need a Code

Why do payout and email changes need a verification code?

Because they are the two changes that let someone else take your money. Your payout method decides where your earnings are sent, and your account email receives every login code, reset code and security notice. So before Sharklio saves a new payout method or email address, it sends a 6-digit code to your email and waits for you to type it in. A stolen password or a browser someone left logged in is not enough on its own. The code expires in 15 minutes and works once, and if you get one you did not ask for, someone is trying that change right now.

For the settings themselves, start with Secure your Sharklio account.

Which Sharklio changes need an email code

Every code is a 6-digit number sent by email, and its subject line names the change.

Changes that do not need a code

• Changing a password you already have: you type your Current password instead, and Sharklio emails you about the change (How to change or set your password).
• Turning Login verification on, revoking trusted devices, and Log out everywhere: they only make the account harder to get into.
• Linking Google or Discord: you sign in on Google’s or Discord’s own page, and a Google account linked or Discord account linked notification appears.
• App settings and app keys: replacing a key creates a notification, but a Postback URL change does not, which is why the hacked account checklist has you check every app by hand.

Why attackers go after payout details

A takeover pays off only if it ends with money the attacker controls. On a publisher account, that is the payout method: change the address once, and the next payout goes to them while your dashboard looks normal. The account email is the second target, because whoever owns it receives your codes and can reset your password.

The pattern is old. In 2018 the FBI’s Internet Crime Complaint Center warned about payroll diversion: criminals phished employees’ logins, redirected their direct deposits to accounts they controlled, often prepaid cards, and added rules to the employee’s account so the alerts about the change never reached them. The FBI advised extra scrutiny of bank detail changes and two-factor authentication for sensitive systems. Swap “direct deposit” for “payout method” and the risk is the same.

Security guidance points to the same fix. The OWASP Authentication Cheat Sheet says to ask for current credentials before updating the password or email address, to defend against session hijacking and cross-site request forgery, and lists changing payment details and adding trusted devices as high-risk actions that call for re-authentication. The OWASP Multifactor Authentication Cheat Sheet names changing the email address and disabling MFA as actions where a second check may be appropriate.

How a payout method change works, step by step

1. Open Account, click Payout method in the section links at the top, then Change payout method (or Choose a payout method if you have none). Pick the method and enter the address.
2. Click Save payout method. The hint beside it says: “To keep your payouts safe, we email you a code to confirm the change.”
3. The card shows the new method with a Not saved yet badge. Your current payout method stays in place.
4. Open the email “123456 is your code to confirm your Sharklio payout method” (123456 stands for your code) and check the method and address it lists. That is the change the code approves.
5. Type the code under Enter the code from the email to save this payout method and click Confirm. You will see “Payout method saved.”

Send a new code replaces the code, and Cancel drops the change: “Payout method change canceled. Nothing was saved.” The pending change belongs to the browser that started it and lapses with the code after 15 minutes, with the message “This change expired. Save your payout method again to get a new code.”

Once saved, you get an email titled “Your Sharklio payout method was changed” (or “was added” for your first one) with a Check your payout method button, a notification under the bell, and a Payout method changed line in Recent security activity. The email ends: “If you did not make this change, contact partners@sharklio.com right away so we can stop the next payout.”

How an email change protects your account

The clicks are in How to change your username or email. What each step guards against:

• Proving it is you. With a password on the account, you type your Current password. Without one, a second code goes to your current address, and that email shows the new address partly hidden.
• Proving the new address is real. A code goes to the new address. Until it is entered, your email “stays the same”, and the Email address row offers Enter the code and Cancel change.
• Warning the old address. The old address gets “Your Sharklio email address was changed”, with the new address partly hidden and a Contact support button. Codes then go only to the new address, so this is the last notice your old inbox gets.
• Closing other doors. Other devices are logged out and open codes are canceled. Trusted devices stay, so click Revoke all if the change was not yours.

How Sharklio codes work

A real code email has no button that logs you in. How to spot phishing emails shows how to tell it from a copy.

Got a code you did not ask for? What it tells you

A code is only sent when someone starts a change on sharklio.com, so the subject line tells you what they are trying to do.

Unless you or someone on your own team just started the change, every row except the last means someone else is in your account or holds your password.

What to do with an unexpected code, in order

1. Leave the code alone. Do not type it, forward it or read it to anyone. Nothing changes until someone enters it. The FTC’s alert What’s a verification code and why would someone ask me for it? puts it plainly: never give your verification code to someone else, and anyone who asks for it is a scammer.
2. Open sharklio.com yourself, log in, and check Activity on the Account page for logins you do not recognize.
3. Change your password with Change password in the Password row. It logs out every other device, which also ends the session where someone is waiting for your code. Log in only with Google or Discord? Change that account’s password and click Log out everywhere.
4. Click Revoke all in the Trusted devices card, and turn on Login verification if it is off (Login verification, trusted devices and sessions).
5. Check that your payout method and email address are still yours, character by character.
6. Secure your mailbox with its own strong password and two-step login, and delete forwarding rules or filters you did not create, the trick from the FBI’s payroll diversion warning.
7. Tell Sharklio. Click Chat with us under Need help? in the dashboard sidebar, or email support@sharklio.com or partners@sharklio.com. Logged out? Use the contact page with A publisher and Account and login. Include the subject line, the time and any address the email showed, never the code or your password. Section 5 of the Sharklio Terms asks you to report suspected unauthorized access promptly.

Got a “was changed” email for a change you did not make? Then it was already saved, so switch to the full incident checklist for a hacked account.

What an email code can and cannot do

• It is only as strong as your inbox. CISA’s Require Multifactor Authentication guide ranks methods from most to least secure, with security keys first and text or email codes last, as “the weakest protection”. The FTC’s page Use Two-Factor Authentication To Protect Your Accounts calls text or email passcodes better than nothing and lists email among the accounts to protect first. So put a security key or authenticator app on the mailbox your Sharklio account uses.
• It does not cover your apps. Someone logged in can replace app keys or change a Postback URL without a code. How to keep your app secret safe explains where keys should live.

Outside guidance in this article was checked on November 2, 2026.

Frequently asked questions