Can my bank ever ask me to share my one-time passcode (OTP) over the phone?

One-time passcodes are a second layer of security specifically designed to ensure only you — the account holder physically holding the registered device — can authorise a transaction. The entire security model breaks down if the code is shared. Banks know this, which is why their messages and apps typically contain explicit warnings such as 'Never share this code with anyone, including bank staff.'

The attack works like this: a fraudster has obtained your account credentials through phishing or a data breach. They initiate a login or transaction on your account, which triggers your bank to send you a genuine OTP. They then call you — often already knowing your name and partial account details to seem credible — and request the code under the pretext of verifying your identity or reversing a fraudulent transaction.

Once you read out the OTP, the fraudster completes the login or transaction within the seconds the code is valid. They may then change your password, set up new payees, or drain your account before you realise what happened.

No legitimate bank representative, customer service agent, or fraud department employee will ever ask for your OTP. If you receive such a call, hang up and change your passwords immediately. Contact your bank through the official app or the number on your card.