# How do banks stop OTP bots?

> **Short answer:** Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.

- URL: https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/
- Last verified: 2026-09-01 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## Remove the code

An OTP bot only works if there is a code to ask for. Passkeys, in-app approval on a registered device and network-based verification leave the customer nothing to read out.[^1] Phishing-resistant methods also defeat the fake-website version of the same attack.[^2]

## If a code is unavoidable

- **Put context in the message:** say what the code approves (“to add payee J. Smith”) and that the bank will never ask for it.
- **Watch the timing:** a login from a new device while the customer is on an inbound call is a strong fraud signal.
- **Shorten the window:** the shorter a code is valid, the less time a bot has to relay it.

## Where to start

Start with the flows where a relayed code does the most damage: new-device login, new payees and limit increases. For a full program, see [migrate a bank off SMS OTP](https://glide-cleartext.pages.dev/checklists/migrate-a-bank-off-sms-otp/).

## What this means for you

### Banks & credit unions

Prioritize the flows the bots target: login from a new device, adding a payee and raising limits. Those are where removing the code has the biggest effect.

### Fintechs & payment firms

In-app approval on a device you registered earlier is often the fastest replacement to ship, because customers already have your app.

### Developers & identity teams

Make code messages specific: the action, the payee or amount, and a warning. “Your code to add payee J. Smith is 481 223. We will never call you to ask for it.”

## Follow-up questions

**Does customer education stop OTP bots?**

It helps at the margin, but the calls are timed to arrive with a real code and sound official. Removing the code is more reliable than asking customers to spot the scam.


## Sources

[^1]: One-time passcodes are gateway for financial fraud attacks. BankInfoSecurity, 2026-04-03. https://www.bankinfosecurity.com/one-time-passcodes-are-gateway-for-financial-fraud-attacks-a-31341 (secondary)
[^2]: Implementing Phishing-Resistant MFA (fact sheet). CISA, 2022-10. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf

## Related questions

- [What is an OTP bot?](https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/)
- [What is phishing-resistant MFA?](https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/)
- [Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/)
- [How can banks defend against SIM swap fraud?](https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/)

## Cite

Cleartext. “How do banks stop OTP bots?” Last verified 2026-09-01 (rev. 1). https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/

## Changelog

- 2026-09-01: First published.