OTP scam: why you never tell it to a bank caller

A friend got an "account blocked" call. He thinks reading the one-time password, the OTP, to the caller is safe. It isn't, and the reason is in what the code is for.

A bank never asks

A bank never asks for your OTP, PIN or password, whether on a call, SMS or chat. Whoever asks is the scam. That rule has no exceptions, so you don't need to judge how convincing the caller sounds.

What the OTP is

An OTP is a code that works once. It is the final approval for a payment, like a signature. The bank sends it because it must check that the person starting the action is really you.

Think of a signature on a form. Nobody hands theirs to a stranger who phoned them. The code deserves the same treatment.

Picture a flow with the scammer on one end, the bank server in the middle and your phone at the other end.

How the scam runs

The scammer, posing as a bank caller, starts a payment from your account. The bank server must check it is really you, so it checks, then sends an OTP.

The OTP arrives on your phone by SMS, and not on his. That is the step the whole call is built around. The code lands with you, so he needs something from you.

So he scares you with "account blocked". Fear is the lever. The line is there to make you act before you think. Then you read the code out, and your own approval pays him.

Look at the moment from your side. A code just arrived while a caller is on the line. That combination is the warning sign.

What to do instead

Hang up. Call the number on your card. Then report it. In India, dial 1930, the fraud helpline for cyber fraud.

No real bank needs your OTP. If a call ends with "just read me the code", the call is the problem.

Send the reel to the friend who reads OTPs out to any bank caller. Next time your phone shows a code you didn't expect while someone is on the line, remember it is your signature, and keep it to yourself.