SECURITY
Why You Should Never Share an OTP
See what an OTP can approve and what to do if another person asks for or receives your code.
A one-time password is temporary, but the action it approves can be permanent. A code may register a new device, reset a password, confirm a transfer or expose private data. Anyone asking for the code may be attempting to complete that action as you.
The code is an authorisation
Think of the OTP as your signature for the exact action described in the message. It is not a general identity check for a caller. Support teams should not need it. Delivery drivers, marketplace buyers, recruiters and bank representatives also have no legitimate reason to request a login or payment OTP.
Unexpected codes are a warning
A code you did not request often means someone entered your phone number or password. Do not reply to the message or contact numbers included in suspicious texts. Open the official account directly, change a reused password and review recent devices, recovery details and transactions.
Protect notification previews
A locked phone can still reveal codes if message previews are visible. Configure sensitive notifications to show only after unlock, use a device passcode and remove unknown fingerprint or face profiles. Keep the phone operating system and messaging app current.
Respond quickly after a mistake
If you shared a code, assume the action may have completed. Reset credentials, revoke sessions and contact official support. For payments, call the financial institution immediately. Keep evidence such as message timestamps and transaction references, but redact codes and personal data before sharing a complaint.
Quick checklist
- Enter codes only in the official service
- Read the action in the message
- Hide lock-screen previews
- Review unexpected requests
- Act immediately after accidental sharing
Frequently asked questions
Can a code be safe to share after it expires?
Do not share it. The message can still reveal account and transaction information.
Will genuine support ever ask for an OTP?
Treat such a request as suspicious and verify through the organisation’s official published channel.