A one-time password is a single-use code sent to something you have, like a phone or email, to authenticate you or approve an action. It is everywhere, which means its weaknesses are everywhere too, so treat a passed OTP as a step-up signal, not strong standalone proof.
What is an OTP, in plain English?
A one-time password is a short, single-use code delivered to something the user has, usually a phone by SMS, an email inbox, or an authenticator app. The user enters it to prove they control that channel, which authenticates a login or approves an action like a transfer. Because each code works once and expires quickly, a captured code has a short shelf life.
It counts as a possession factor, something you have, and it is genuinely useful as an extra step beyond a password. Its strength is convenience and reach: almost everyone has a phone or email, so OTP is easy to roll out and familiar to users, which is why it is one of the most common second factors in the world.
That ubiquity is also the problem. OTP is among the weaker factors, exposed to SIM swaps, malware that reads codes, social-engineering handoff where a victim is coaxed into sharing the code, and real-time phishing that relays it the instant it is entered. In fraud and AML, watch for users coached to read a code aloud, and treat a passed OTP as a step-up signal rather than strong standalone proof of identity.
How attackers beat OTP
Attack | How it defeats the code |
SIM swap | The phone number is hijacked, so SMS codes go straight to the attacker. |
Real-time phishing | A fake site relays the code to the real service the moment the victim types it. |
Social engineering | The victim is coached to read the code aloud to a caller posing as support. |
Malware | Software on the device reads incoming codes and forwards them silently. |
Who is involved?
Who | Their role |
The user | Receives and enters the code, and can be tricked into sharing it. |
The service | Generates and sends the code and validates what the user enters. |
The fraud team | Treats OTP as a soft factor and watches for coaching and relay patterns. |
The attacker | Intercepts, relays, or socially engineers the code out of the victim. |
What it looks like in practice
In practice
A victim gets a call from someone claiming to be their bank's fraud team, warning of a suspicious charge. To verify you, the caller says, we are sending a code, please read it back. The victim, rattled and trusting, reads the OTP aloud. That code was really the attacker's login or transfer approval.
On your side, the OTP passes cleanly: the right code was entered on time. Nothing about the code itself looked wrong. Only the surrounding signals gave it away, a new device, an unusual location, and a transfer moments after the code, which is why the OTP was treated as one input among many rather than trusted on its own.
Why it matters to operators
OTP is worth having, because it does raise the bar above a password alone and it is easy for users. But its weaknesses are widespread, so leaning on it as strong proof invites trouble. SIM swaps, real-time phishing, and coached handoffs mean a valid code can arrive fully in the attacker's control while looking perfectly normal to your system.
Two habits keep OTP honest. Treat a passed OTP as a step-up signal to combine with device, behavior, and location, not as standalone proof of identity. And for high-value or sensitive actions, prefer stronger, phishing-resistant factors like passkeys, since there is nothing for a victim to read aloud or an attacker to relay.
What to watch in the data
- Coached read-aloud. An OTP approved during or right after a phone call is a classic social-engineering signal.
- New device, instant code. A code entered seconds after issue from an unfamiliar device or location can indicate a phishing relay.
- Recent SIM swap. A number changed shortly before an OTP-protected action points to interception.
- OTP guarding high value. A large transfer approved solely by an SMS code is under-protected for its risk.
- Repeated code requests. Many OTP requests in a short window can mean an attacker probing or a relay in progress.
Quick questions
Is an OTP a strong factor?
It is a possession factor and better than a password alone, but it is among the weaker options. SIM swaps, malware, real-time phishing, and social engineering can all deliver the code to an attacker, so it should not stand alone for sensitive actions.
Why is SMS OTP especially risky?
Because the code is tied to a phone number that can be hijacked through a SIM swap, and SMS can be intercepted. App-based or push OTP is somewhat better, but phishing-resistant factors like passkeys are stronger still.
How does real-time phishing beat OTP?
A fake site captures the victim's password and OTP and instantly relays them to the real service before the code expires. Because the code is single-use and used immediately, its short lifespan does not help.
What should replace OTP for high-value actions?
Phishing-resistant possession factors such as passkeys or hardware keys, which cannot be relayed or read aloud. Where OTP stays, pair it with device, behavior, and location signals rather than trusting the code alone.
Why treat a passed OTP as just a signal?
Because a valid code can be in the attacker's hands through interception or coaching while looking normal to you. Combining it with other risk signals catches the cases where the right code is entered by the wrong person.
Go deeper
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.