FRAUD PREVENTION
How to Spot OTP Scams and Fake Verification Requests
Recognise common OTP scam patterns, suspicious calls and fake login pages before sharing a code.
OTP scams succeed by creating urgency. The caller may claim that a payment must be cancelled, KYC is expiring, a parcel is blocked or support needs to verify you. The code actually approves an action the attacker started. The simplest defence is a firm rule: an OTP is entered only into the official app or website for an action you initiated.
Common warning signs
Be suspicious when someone asks you to read a code aloud, install a screen-sharing app, open a shortened link or stay on the call while a message arrives. Other warnings include threats of account closure, promises of refunds and requests to move the conversation to a private chat. Genuine urgency does not remove the need to verify independently.
Read the complete message
Do not focus only on the digits. The text usually states what the code authorises: login, password reset, device registration or payment. If that action does not match what you are doing, stop. Never send a screenshot because it may reveal the code, sender, phone number and other account details.
Verify through a separate channel
End the call and contact the organisation using the number printed on its official website, app or bank card. Type the address yourself rather than using the link in the message. Do not trust caller ID alone; it can be spoofed. A real support agent can continue without asking for the OTP.
If you shared a code
Immediately change the password from a trusted device, sign out other sessions and contact the service’s official fraud team. For financial accounts, call the bank and block affected payment methods. Contact the mobile carrier if service disappeared unexpectedly. Preserve messages and transaction details for a formal report, but do not post the OTP publicly.
Quick checklist
- Pause when urgency is used
- Read what the code authorises
- End unexpected calls
- Contact official support independently
- Secure the account immediately after exposure
Frequently asked questions
Can caller ID prove a bank is calling?
No. Caller ID can be spoofed; call back using an official number.
Should I share an OTP to receive a refund?
No. Receiving a genuine refund should not require you to disclose a login or transaction OTP.