OTP Bot & One-Time-Passcode Interception Scams

An OTP bot scam is a method for defeating two-factor authentication by getting you to hand over the one-time passcode yourself. Two-factor login and payment approvals rely on a short code — sent by text, email, authenticator app, or automated call — that only the real account holder should ever see. The scammer already has your username and password (from a breach, phishing, or a purchase on a criminal marketplace), but the code stops them. So they trigger it, then call or text you to extract it. The "bot" is automated software, frequently sold and rented through Telegram channels, that places convincing spoofed calls or messages impersonating your bank, card provider, or a service like a payment app, email provider, or exchange. It reads a natural-sounding anti-fraud script, prompts you to "verify" by entering or reading back the code that just arrived, and relays whatever you provide to the waiting attacker in real time. The distinction that matters most: the code authorises an action the scammer initiated, not one you did.

The sequence is tightly choreographed around a few seconds. Having obtained your login details, the attacker enters them on the real service — your bank, email, or a payment app — which triggers a genuine one-time passcode sent to your own phone. At almost the same instant, the OTP bot contacts you. A spoofed call shows your bank's real name or number, and an automated, professional voice warns of "suspicious activity" or a payment you didn't make, then says it must "verify your identity" before blocking it. It instructs you to key in or read out the code you've just received. Because the text genuinely came from your bank moments earlier, the timing feels like proof the call is real. The bot captures the digits and relays them to the attacker, who types them into the live login or payment screen, completing the takeover before the call ends. More advanced bots handle several codes in one session — chaining a login, a device enrolment, and a payment approval — and can prompt for card numbers, PINs, or your date of birth using the same trusted-sounding script.

This scam inverts the psychology of security. Codes are framed by legitimate services as a protection you must guard, so a caller who claims to be checking that protection sounds like an ally, not an attacker. Three cues stack to disarm you: caller-ID spoofing that displays a real bank name or number, a text you can see actually arrived, and the urgency of fraud you're told is happening right now. Fear of losing your money overrides the instinct to slow down. Automation makes it worse — a bot sounds like the polished IVR systems banks really use, runs the same reliable script against thousands of people, and never fumbles. Crucially, most people don't hold the one rule that defeats it: a code proves identity to the machine, so anyone who phones asking for it is, by definition, trying to be you.

This is the fraud prevention line for your bank. We've detected a £940 payment to a new payee. To block it, please enter the six-digit code we've just sent to your phone.

Your account security code is 284915. We will never call to ask for this code. If you did not request it, do not share it with anyone.

Verizon Security: someone is attempting to sign in to your account from a new device. Reply with the verification code to stop this login.

To confirm this is really you and cancel the transfer, read me the code you just received. Do not end the call — the request expires in 60 seconds.

Treat any inbound contact about your account as unverified, no matter what the caller ID shows — spoofing makes the displayed name and number worthless as proof. Never read out, type into a keypad, or forward a one-time code to anyone who contacted you; legitimate banks, card providers, government bodies, and services never ask you to confirm a code back to them, because on their side the code has already done its job. Read the text itself, not the caller's summary of it: genuine security messages usually say plainly "we will never ask you for this code" and often name the exact action being authorised — a login, a new payee, a payment amount. If that action isn't one you started, someone else did. Hang up, then reach your bank independently using the number printed on your card or its official app or website, and ask whether any contact was real. The pause costs a genuine agent nothing and costs the scammer everything.