# What is an OTP bot?

> **Short answer:** An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.

- URL: https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/
- Last verified: 2026-09-01 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## How an OTP bot attack works

1. The criminal already has the victim’s username and password, usually from a breach or a phishing page.
2. They start a login or payment, which makes the bank send the victim a one-time passcode.
3. At the same moment, the bot calls the victim, claims to be the bank’s fraud team, and asks them to “confirm” the code they just received.
4. The victim reads it out or types it into the keypad, and the bot passes it straight to the criminal.

## Why it keeps working

The call arrives exactly when the real code does, which makes it convincing. And a one-time passcode has no way of knowing who is typing it in or where: it works for anyone who has it within its validity window.[^1] How to break the pattern: [how banks stop OTP bots](https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/).

## What this means for you

### Banks & credit unions

OTP bots turn every SMS or voice code into a social-engineering target. Customers who ‘confirm a code’ with a caller claiming to be your fraud team are the pattern to watch for.

### Fintechs & payment firms

Your support scripts should say, in every channel, that you will never ask for a code. Put the same sentence in the code message itself.

### Developers & identity teams

Log when a code was sent and when it was used, from which device and IP. A code entered from a new device seconds after it was sent to an old one is a strong signal.

## Follow-up questions

**Why are they called bots?**

They automate the social-engineering call that used to need a human caller, so criminals can run many attempts at once.


## Sources

[^1]: One-time passcodes are gateway for financial fraud attacks. BankInfoSecurity, 2026-04-03. https://www.bankinfosecurity.com/one-time-passcodes-are-gateway-for-financial-fraud-attacks-a-31341 (secondary)

## Related questions

- [How do banks stop OTP bots?](https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/)
- [What is phishing-resistant MFA?](https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/)
- [What is a SIM swap attack?](https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/)
- [Is email OTP safer than SMS OTP?](https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/)

## Cite

Cleartext. “What is an OTP bot?” Last verified 2026-09-01 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/

## Changelog

- 2026-09-01: First published.