Domain
Fraud questions
Account takeover, OTP bots and authorized push payment scams, and the controls that stop them.
Questions #
- How do banks stop OTP bots?
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out.
- What is an OTP bot?
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
- What is APP fraud?
Authorized push payment (APP) fraud is a scam in which the victim is tricked into sending a payment themselves, for example to someone impersonating their bank, a supplier or a romantic partner.
- Who pays when a UK customer falls for an APP scam?
Since October 7, 2024, UK payment firms must reimburse most eligible victims of authorized push payment scams made over Faster Payments, up to £85,000 per claim.