Usually, yes. A one-time code is often the final key an attacker needs to sign in or reset your password. Never read it to an unsolicited caller or send it by text or email.
Why you received the code
The attacker may already know your password or be attempting account recovery. They create the real code, then impersonate support and ask you to provide it.
What to do
End the conversation. Contact the company using its official app, website, or a number on your card. If you shared the code, contact the company and your IT team immediately.
This page provides general security guidance, not a guarantee that any individual message is safe. When money, passwords, remote access, or sensitive records are involved, verify through a separate trusted channel.