Question Fraud
How do banks stop OTP bots?
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.
How do banks stop OTP bots? Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal. Source: https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/ (Cleartext, verified 2026-09-01)
Remove the code #
An OTP bot only works if there is a code to ask for. Passkeys, in-app approval on a registered device and network-based verification leave the customer nothing to read out.[1] Phishing-resistant methods also defeat the fake-website version of the same attack.[2]
If a code is unavoidable #
- Put context in the message: say what the code approves (“to add payee J. Smith”) and that the bank will never ask for it.
- Watch the timing: a login from a new device while the customer is on an inbound call is a strong fraud signal.
- Shorten the window: the shorter a code is valid, the less time a bot has to relay it.
Where to start #
Start with the flows where a relayed code does the most damage: new-device login, new payees and limit increases. For a full program, see migrate a bank off SMS OTP.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Prioritize the flows the bots target: login from a new device, adding a payee and raising limits. Those are where removing the code has the biggest effect.
Fintechs & payment firms
In-app approval on a device you registered earlier is often the fastest replacement to ship, because customers already have your app.
Developers & identity teams
Make code messages specific: the action, the payee or amount, and a warning. “Your code to add payee J. Smith is 481 223. We will never call you to ask for it.”
Follow-up questions #
- Does customer education stop OTP bots?
- It helps at the margin, but the calls are timed to arrive with a real code and sound official. Removing the code is more reliable than asking customers to spot the scam.
People also ask #
What is an OTP bot?
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
Full answerWhat is phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.
Full answerAre synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Full answerHow can banks defend against SIM swap fraud?
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “How do banks stop OTP bots?” Last verified 2026-09-01 (rev. 1). https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/
Markdown link
[How do banks stop OTP bots?](https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/) (Cleartext, verified 2026-09-01)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |