Question Fraud
What is an OTP bot?
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
What is an OTP bot? An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment. Source: https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/ (Cleartext, verified 2026-09-01)
How an OTP bot attack works #
- The criminal already has the victim’s username and password, usually from a breach or a phishing page.
- They start a login or payment, which makes the bank send the victim a one-time passcode.
- At the same moment, the bot calls the victim, claims to be the bank’s fraud team, and asks them to “confirm” the code they just received.
- The victim reads it out or types it into the keypad, and the bot passes it straight to the criminal.
Why it keeps working #
The call arrives exactly when the real code does, which makes it convincing. And a one-time passcode has no way of knowing who is typing it in or where: it works for anyone who has it within its validity window.[1] How to break the pattern: how banks stop OTP bots.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
OTP bots turn every SMS or voice code into a social-engineering target. Customers who ‘confirm a code’ with a caller claiming to be your fraud team are the pattern to watch for.
Fintechs & payment firms
Your support scripts should say, in every channel, that you will never ask for a code. Put the same sentence in the code message itself.
Developers & identity teams
Log when a code was sent and when it was used, from which device and IP. A code entered from a new device seconds after it was sent to an old one is a strong signal.
Follow-up questions #
- Why are they called bots?
- They automate the social-engineering call that used to need a human caller, so criminals can run many attempts at once.
People also ask #
How do banks stop OTP bots?
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.
Full answerWhat is phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.
Full answerWhat is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.
Full answerIs email OTP safer than SMS OTP?
Not meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What is an OTP bot?” Last verified 2026-09-01 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/
Markdown link
[What is an OTP bot?](https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/) (Cleartext, verified 2026-09-01)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |