An OTP scam tricks you into handing over a short-lived verification code or entering it on a fraudulent page. The attacker may use that code to sign in, reset credentials, register a messaging account or authorize an action. The useful question is not just whether a code is genuine: it is whether the action and the destination are yours.
If you have already shared a code, stop the conversation and contact the affected service through its app or a contact route you independently verify. If money is at risk, contact the payment provider immediately. Do not wait for the code to expire: an attacker may already have used it.
What an OTP does—and what it cannot prove
OTP means one-time password. Services also call these verification codes or one-time passcodes. A code may arrive by text or voice, or be generated by an authenticator app. Its precise purpose depends on the service and the screen requesting it.
Single use limits reuse of the same code. It does not establish that the person requesting it is trustworthy. A scammer can relay a valid code to a real service while it is still usable. NIST distinguishes replay resistance from phishing resistance: manually entered OTPs are not phishing-resistant. Properly implemented passkeys and security keys bind authentication to the legitimate service. NIST authentication guidelines.
Recognize the request before responding
The following situations are illustrative patterns, not accounts of verified victims. Treat the requested action as the evidence; a familiar logo, caller name or urgent story cannot establish authority.
A caller offers to cancel fraud or unlock your account
A caller says a code will reverse a payment or confirm your identity. Instead, it may complete the action the attacker started. End the call and open the provider’s app or use the number on your statement. The FTC describes verification-code theft through impersonation and recommends independently contacting the provider. FTC verification-code guidance.
A message sends you to a convincing sign-in page
A page that asks for your password and then a code may be a copy of the real login screen. Open the service using your saved bookmark or app instead. When checking a web address, inspect the actual hostname, not a company name somewhere in the path. A padlock only shows an encrypted connection to that site; it does not establish the site’s legitimacy.
A buyer, recruiter or familiar contact asks you to forward a code
Someone claims a code proves you are a real seller, activates an offer or fixes a friend’s account. Do not transfer your account credentials to solve someone else’s problem. Contact a familiar person through a separate known channel. The FTC documents a marketplace impersonation pattern in which a requested code links the victim’s number to a different service. FTC marketplace verification-code example.
Your phone unexpectedly loses service
A service outage alone does not prove fraud. But unexpected loss of service alongside a SIM-change notice or account activity warrants an immediate check with your carrier. A SIM swap transfers control of your number; the attacker may receive subsequent SMS codes without asking you to share one. See our SIM swap and eSIM recovery guide.
Four checks before entering a code
- Identify the action. Did you start this login, payment, reset or registration yourself?
- Read the message. Which service, transaction or device does it describe? Stop if it differs from your intention.
- Verify the destination. Use the official app or independently opened website. Do not let a caller dictate where to enter the code.
- Keep the code private. Do not dictate it, forward it, share your screen or approve an unexpected sign-in prompt.
A delivery or pickup service may have a separate handover code. That does not justify sharing a bank, sign-in or account-recovery code. Check the code’s purpose in the official order screen before using it.
Choose protections that address the right risk
| Control | Useful role | Limit |
|---|---|---|
| SMS verification | Adds a verification step | Depends on control of your phone number; codes can still be phished |
| Authenticator app codes | Avoid SMS delivery for that factor | Still vulnerable if entered on a phishing page |
| Passkey or security key | Provides phishing-resistant authentication when implemented correctly | Recovery routes and compromised devices still require attention |
| Carrier account PIN or transfer lock | Adds checks to carrier account changes, where offered | Availability and enforcement vary; not a guarantee |
| SIM PIN | Locks use of that SIM or eSIM after a restart or SIM removal | Does not itself stop the carrier issuing a replacement SIM |
The authentication comparison follows NIST’s guidance. A SIM PIN and a carrier account PIN perform different jobs. Apple explains SIM PIN locking; do not guess a SIM PIN, because incorrect attempts can lock it. FTC SIM-swap guidance recommends carrier account protection and alternatives to text-message verification.
What to do if you shared a code
Use a trusted device if you suspect the device you used is compromised. Work through the affected service’s recovery process; changing one password may not remove every session or changed recovery setting.
- Notify the affected provider. Explain which action the code described and when you shared it. For a payment, ask about blocking further activity, disputing the transaction and any available recall process.
- Secure account access. Change an exposed or reused password. Review signed-in devices, recovery email addresses and phone numbers, and remove changes you do not recognize.
- Check your email account. Review forwarding rules and connected access if email could be used to reset other accounts. Google’s recovery guidance illustrates the checks for its own service; follow equivalent controls from your provider. Google compromised-account recovery.
- Contact your carrier when your number may be affected. Ask it to investigate unauthorized transfers or SIM changes and restore your service.
- Keep evidence. Save the message, sender details, times, transaction references and provider case numbers privately. Do not post codes or account details publicly.
Report the incident through the relevant platform and the verified fraud-reporting authority in your location. Refund rights, deadlines and available remedies depend on the payment method, circumstances and jurisdiction. Prompt reporting matters, but this guide cannot promise reimbursement. Avoid anyone requesting another payment to recover a loss.
A small account-safety worksheet
Record this without including passwords, codes or recovery secrets: account name; verified support route; available passkey or security-key option; current recovery contact; carrier transfer protection; date you checked active sessions. Keep recovery codes separately in a secure place.
Common questions
Does an unexpected code mean my account is already compromised?
No. It can mean someone attempted an action, or entered a number incorrectly. Do not share it. Check activity directly in the account if the message or repeated attempts concern you.
Is there no risk once the code expires?
Expiry prevents later use of that code. It cannot undo an earlier successful sign-in or transaction. Check account activity and recovery settings rather than relying on expiry.
Should I disable verification because SMS has weaknesses?
Do not abandon an available verification layer without arranging a suitable replacement. Use a phishing-resistant option where your service supports it, and secure recovery methods too.
Glossary
- Phishing: impersonation that seeks credentials or another harmful action.
- Smishing: phishing delivered through text messages.
- TOTP: a time-based one-time password generated by an authenticator.
- SIM swap: an unauthorized change that gives someone else control of your mobile number.
- Passkey: a cryptographic sign-in credential used through a device or credential manager.
For related scam patterns, read our WhatsApp task-scam guide.
Sources and editorial review
Updated 1 October 2026. Technical statements were checked against NIST authentication guidance, provider documentation and the linked consumer-protection guidance. Examples are illustrative. No victim interviews, device forensics or independent product testing are claimed. Provider-specific recovery instructions apply to that provider; local legal remedies are not presented as worldwide rules. Send correction requests through our contact page.
Written and prepared by Kshitij Gupta.
