Never act from a link or a number in the message
Both are chosen by the sender. If the message claims to be from a company you use, close it and open that company's app or type their address yourself. The whole fraud depends on you using their route rather than yours, so any real message survives being verified this way — and a fake one falls apart.
A code is the key to your money, not a formality
Nobody legitimate asks you for a one-time code: not a bank, not a courier, not a marketplace, not the police. Somebody asking for one is either using it or is about to. The same is true of a password, a PIN and a photo of your card.
Tell the person it is aiming at
These messages arrive in waves and are sent to lists. A neighbour, a colleague or a parent holding the same message benefits more from one sentence from you than from any tool — and they will believe you when they would not believe a warning.
If you already paid or gave a code, act today, not tomorrow
Call your bank on the number on the back of your card and say you were defrauded. Ask them to recall the transfer or block the card. Report it to the police as well; a bank is far more likely to help when there is a report, and the first hours are the ones that decide whether the money comes back.