Briefing / Primer / Fraud
Why OTP bots keep working against bank customers
Automated calls that impersonate a bank get customers to hand over one-time passcodes in real time. The weakness is the code itself.
[EDITORIAL: sample briefing drafted with AI assistance. Verify every claim against its sources before launch.]
BLUF An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
Moderate confidence
One secondary source plus widely documented attack mechanics.
Key points
- OTP bots automate the social-engineering call that used to need a human.
- They work because a one-time code can be used by whoever has it.
- Phishing-resistant methods remove the code the bot asks for.
How an OTP bot attack works
- The criminal already has the victim’s username and password, usually from a breach or a phishing page.
- They start a login or payment, which makes the bank send the victim a one-time passcode.
- At the same moment, the bot calls the victim, claims to be the bank’s fraud team, and asks them to “confirm” the code they just received.
- The victim reads it out or types it into the keypad, and the bot passes it straight to the criminal.
Why it keeps working
The call arrives exactly when the real code does, which makes it convincing. And a one-time passcode has no way of knowing who is typing it in or where: it works for anyone who has it within its validity window.[1]
What stops it
- Remove the code: passkeys, in-app approval on a registered device and network-based verification leave the customer nothing to read out.
- Put context in the message: if a code is unavoidable, say what it approves (“to add payee J. Smith”) and that the bank will never ask for it.
- Watch the timing: a login from a new device while the customer is on an inbound call is a strong fraud signal.
Sources
- One-time passcodes are gateway for financial fraud attacks BankInfoSecurity, 2026-04-03
Changelog
- Published.