Keep it very simple: never give an SMS authentication code to anyone on a phone call, in response to a text message or email, or as part of any checkout or purchase. They are only to be used when logging in to an online account. Anything else is a scam.
Even that may be too complicated, now that I read it back.
Even that may be too complicated, now that I read it back.