A one-time password (OTP) is a temporary authentication code used to verify a user's identity during a login, account change, payment, or other sensitive action. Unlike a static password, an OTP is designed to be used once or within a limited validity period, and may be delivered by SMS, email, voice, push notification, or generated by an authenticator application.
OTPs are widely used as an authentication factor in multi-factor authentication (MFA) and payment authentication. They can provide useful protection against stolen passwords, but an OTP does not prove that the person entering the code is the legitimate customer: if a fraudster obtains the code through phishing, social engineering, malware, SIM swap, or an OTP bot, the code can potentially be used to complete the attack.
How does an OTP work?
An OTP authentication flow typically works as follows:
- The customer initiates an action — such as logging in, resetting a password, changing account information, or making a payment.
- The authentication system generates an OTP — usually a randomly generated code associated with that user and authentication event.
- The OTP is delivered or generated — for example, through SMS, email, a mobile application, or an authenticator app.
- The customer enters the OTP — usually into the website, mobile application, or payment authentication interface.
- The authentication system validates the code — checking that it is correct, valid and has not already been used.
- The requested action is completed or challenged further — depending on the authentication result and the risk associated with the action.
The important distinction is that OTP verification validates possession of a code or authentication factor; it does not, by itself, establish that the person entering the code is acting legitimately. Modern authentication therefore increasingly combines OTPs or other authentication factors with contextual, behavioural and device intelligence.
What are the different types of OTP?
OTP is a broad category that includes several different approaches.
SMS OTP
An SMS OTP is sent to the customer's registered mobile number. It remains widely used because it works across many devices and does not require a dedicated authentication application.
However, SMS OTP can be exposed to risks including SIM swapping, number porting, malware, interception and social engineering. SMS delivery can also be delayed or disrupted.
Email OTP
An email OTP is delivered to the email address associated with the account. It can be convenient, but its security depends partly on the security of the email account itself.
Time-based one-time password (TOTP)
A TOTP is generated locally by an authenticator application or hardware token using a shared secret and the current time. Unlike SMS OTP, it does not depend on the mobile network for each authentication event.
Push-based authentication
With push authentication, the customer receives an authentication request in a trusted application and confirms or rejects it. Depending on the implementation, additional information about the transaction or authentication request can be displayed to help the customer make an informed decision.
OTP vs MFA: what is the difference?
An OTP is an authentication mechanism; MFA is an authentication approach that uses two or more independent authentication factors.
An OTP can therefore be used as one factor within MFA. For example, a customer might authenticate using a password plus an SMS OTP.
However, simply adding an OTP does not make an authentication flow immune to fraud. If both the password and OTP are obtained through phishing or social engineering, an attacker may be able to bypass the intended protection.
What are the security risks of OTP authentication?
OTPs can improve security compared with static passwords, but they are not inherently phishing-resistant.
Common OTP-related threats include:
Phishing: Fraudsters can create convincing websites or applications that ask customers to enter their OTP. The attacker can then use the code in real time against the legitimate service.
Social engineering: Attackers may impersonate a bank, merchant, fraud team or other trusted organisation and persuade a customer to disclose an OTP.
SIM-swap fraud: A fraudster may socially engineer or otherwise compromise a mobile account and move the victim's phone number to a SIM controlled by the attacker. SMS OTPs can then be delivered to the attacker's device.
OTP bots: OTP bots are automated tools used to facilitate real-time social-engineering attacks against OTP users. They can trigger an authentication request and then contact the victim through a phone call, text message or other channel while impersonating a trusted organisation.
Malware and device compromise: Malware can potentially intercept authentication information or compromise the device receiving or entering the OTP.
Adversary-in-the-middle attacks: An attacker can position a fraudulent interface between the customer and legitimate service, capturing credentials and OTPs as they are entered.
Are OTPs secure?
OTPs can provide useful additional protection, but their security depends on how they are generated, delivered and used.
An OTP is generally stronger than relying on a static password alone because the code is temporary and normally cannot be reused. However, OTPs can still be stolen or socially engineered.
For financial institutions, the key question is therefore not simply:
"Is the OTP correct?"
It is also:
"Does the surrounding evidence indicate that this customer, device, session and transaction are trustworthy?"
This is where risk-based and context-aware authentication can strengthen an OTP-based authentication flow.
How can banks strengthen OTP authentication?
A modern authentication strategy can evaluate additional signals alongside the OTP, including:
- Device identity and reputation
- Customer behaviour
- Transaction characteristics
- Location and network information
- Session behaviour
- Known fraud indicators
- Account history
- Authentication history
- Indicators of automation or bot activity
This enables financial institutions to apply risk-based authentication: low-risk interactions can remain low-friction, while higher-risk interactions can trigger additional verification or a stronger authentication method.
The result is a move away from treating authentication as a binary "OTP correct / OTP incorrect" decision towards evaluating the broader context surrounding the customer and transaction.
OTP and payment authentication
OTPs are commonly used to authenticate online payments, including as part of 3-D Secure challenge flows.
In a 3-D Secure transaction, risk assessment can determine whether a transaction qualifies for a frictionless authentication flow or requires a customer challenge. Where an OTP is used for the challenge, the OTP is one part of the overall authentication process rather than the entire fraud decision.
This distinction matters because a legitimate customer can still be manipulated into providing a valid OTP for a fraudulent transaction.
Are OTPs passwordless authentication?
No. An OTP is not the same thing as passwordless authentication.
An OTP is still a password-like secret used to authenticate a user; its defining characteristics are that it is temporary and generally intended for one-time use. Passwordless authentication instead removes the need for a password-based secret and may use technologies such as passkeys, cryptographic credentials, biometrics, device-based authentication or other authentication mechanisms.
What are alternatives to OTP authentication?
Depending on the use case and risk level, organisations can consider:
- Passkeys and FIDO2 authentication
- Cryptographic device-based authentication
- Push authentication
- Biometrics
- Behavioural authentication
- Risk-based authentication
- Context-aware authentication
- Device intelligence
- Continuous authentication
The strongest approach is not necessarily to eliminate every OTP immediately. Instead, organisations can use risk-aware authentication orchestration to select an appropriate authentication method based on the customer, device, transaction and level of risk.
Key takeaway
OTP authentication remains an important security control, but an OTP should not be treated as proof that a transaction or user is trustworthy. Modern fraud prevention combines authentication factors with contextual, behavioural and device intelligence to determine when to allow an interaction, when to introduce additional verification, and when to block it.
FAQs
What is a one-time password (OTP)?
➡️ A one-time password is a temporary authentication code used once or for a limited period to verify a user's identity.
How does OTP authentication work?
➡️ An authentication system generates a temporary code, delivers or generates it through an authentication channel, and verifies the code when the customer enters it.
Is an OTP the same as MFA?
➡️ No. OTP is an authentication mechanism that can be used as one factor within a multi-factor authentication flow.
Is SMS OTP secure?
➡️ SMS OTP can provide useful additional protection but has known weaknesses, including SIM swap, phishing, social engineering and interception risks.
Can OTPs be phished?
➡️ Yes. Attackers can trick customers into entering OTPs into fraudulent websites or applications and can sometimes use captured codes in real time.
What is an OTP bot?
➡️ An OTP bot is an automated tool used by fraudsters to facilitate attacks designed to obtain a customer's one-time password, often through automated calls, texts or other social-engineering techniques.
What is the difference between OTP and TOTP?
➡️ OTP describes the broader category of one-time passwords. TOTP is a specific type generated from a shared secret and the current time, usually by an authenticator application.
Are OTPs passwordless?
➡️ No. An OTP is a temporary password-like secret. Passwordless authentication uses authentication mechanisms that do not rely on passwords or comparable shared secrets.
What is a more secure alternative to OTP?
➡️ There is no single alternative for every use case. Depending on the risk and customer journey, organisations can use passkeys, device-based authentication, biometrics, push authentication, behavioural intelligence or risk-based authentication.
Can OTP authentication prevent account takeover?
➡️ It can make account takeover more difficult, but it cannot prevent every attack. Fraudsters may obtain OTPs through phishing, social engineering, SIM swaps, malware or OTP bots.