Cleartext

Topic Attack

OTP bots

Automated calls and messages that impersonate a bank and get the victim to hand over a one-time passcode in real time.

Also called: OTP interception bots, vishing bots

Questions (2) #

  • How do banks stop OTP bots?Fraud

    Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out.

    Verified · Rev. 1

  • What is an OTP bot?Fraud

    An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.

    Verified · Rev. 1

Checklists (1) #

ChecklistHow to migrate a bank off SMS OTP

Glossary #

Account takeover (ATO)
When a criminal gains control of a real customer's account, usually with stolen credentials, a phished one-time passcode or a hijacked phone number, and then uses it to move money, change contact details or open new products.
OTP bot
An automated calling or messaging service that impersonates a bank or service and persuades the victim to read out or type in a one-time passcode, which the criminal then uses in real time.