A time-based one-time password is a short code built from a shared secret and the current time, generated in an authenticator app and rotating every 30 seconds or so. It is stronger than a code texted to a phone: the code expires fast and never travels over a message that can be intercepted.
What is TOTP, in plain English?
A time-based one-time password is the six-digit code your authenticator app shows and refreshes every half minute. It works from a shared secret, a seed set up once when you enroll, combined with the current time. Because both your app and the server know the seed and agree on the clock, they can each compute the same code independently, with nothing sent between them.
That last part is the whole advantage. Unlike an SMS code, a TOTP never travels over a network that an attacker can tap or redirect. It is generated locally, it is valid only for a short window, and it rotates constantly, so a stolen code is worthless within seconds. It is a common second factor in two-factor and multi-factor authentication.
In the fraud stack, TOTP sits inside authentication as a possession factor: proof you hold the enrolled device. It is meaningfully stronger than SMS, but it is not unbreakable, and the weak points are the setup and recovery flows where the secret is first handed out.
SMS OTP versus TOTP
What changes | SMS OTP | TOTP |
How the code arrives | Sent over the mobile network. | Generated on the device, nothing sent. |
SIM swap risk | High; the number can be hijacked. | None; not tied to the phone number. |
Interception | Possible in transit or via SS7. | No transit to intercept. |
Real-time relay phishing | Vulnerable. | Still vulnerable. |
Main weak point | The carrier and the number. | Setup and recovery of the seed. |
What it looks like in practice
In practice
A customer secures their account with an authenticator app instead of SMS. A fraudster who has phished the password tries a SIM swap, but it gets them nowhere: the second factor is not tied to the phone number, so hijacking the line yields no code.
Undeterred, the fraudster spins up a real-time phishing page that mirrors the real login. The victim enters their password and current TOTP, and the page relays both to the genuine site within the code's short window. The fraud team catches it not from the code itself but from the context: a new device, an unusual location, and a login velocity that does not match the customer, prompting a step-up before the session is trusted.
Why it matters to operators
Moving customers from SMS codes to TOTP closes off two of the most common account-takeover routes at once: SIM swaps and code interception. For any account worth protecting, that is a straightforward, high-value upgrade, and it costs the customer only an authenticator app.
What TOTP does not fix is real-time relay phishing, where a live code is passed straight through to the real site, or a seed that was stolen or set up under coercion. So harden the flows that matter most: protect enrollment and recovery, where the shared secret is issued, and layer device and behavioral signals on login so a relayed code alone is not enough to trust a session.
What to watch for
- Recovery abuse. If resetting TOTP is easy, that becomes the attack path; scrutinize the reset flow as hard as login.
- Relay phishing. A valid code from a new device in an odd location can be a live-relayed session, not the real user.
- Coerced setup. A victim guided by a scammer may enroll the fraudster's authenticator; watch enrollment context.
- Seed exposure. If the setup QR or secret can be captured, every future code is compromised.
- Fallback to SMS. An account that silently downgrades to SMS on failure reopens the SIM-swap hole you closed.
Quick questions
Why is TOTP stronger than an SMS code?
Because the code is generated on the device from a shared secret and never travels over the network. That removes SIM-swap and interception risk, which are the two most common ways SMS codes get stolen.
Can TOTP be phished?
Yes. A real-time phishing page can capture a live code and relay it to the genuine site within its short validity window. TOTP resists many attacks but not this one, which is why device and behavioral signals still matter at login.
What happens if the seed is stolen?
Then an attacker can generate the same codes as the user indefinitely, because the seed plus the clock is all it takes. That is why protecting the setup flow, where the seed is issued, is the single most important control.
Is TOTP the same as a passkey?
No. A passkey uses public-key cryptography bound to the site and is resistant to relay phishing; TOTP is a shared-secret code that can still be relayed. Passkeys are generally the stronger option where they are supported.
Where is the biggest risk?
The setup and recovery flows. That is where the shared secret is handed out or reset, so a weak enrollment or an easy reset hands an attacker the keys regardless of how strong the codes are day to day.
Go deeper
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.