A one-time password (OTP) is a temporary code used to verify a login, payment, or other sensitive action. It may be generated by an app or sent by text or email, and is typically valid for a short time or a single use. OTPs add a layer of protection, but they do not prove that a request is genuine.
Criminals commonly try to obtain OTPs through phishing or impersonation, for example by posing as bank staff and creating urgency. If a victim shares a code, an attacker may use it to complete an action the victim was asked to approve. Never disclose an OTP to someone who contacts you, or enter it after following an unsolicited link. Verify requests through the institution’s official app or website, and treat unexpected OTP messages as a warning that someone may be trying to access an account.