OTP bot hardening

Checklist items

1. Remove codes from new-device sign-in, new payees and payment step-up first.
2. Rewrite code messages to say what the code approves and that the bank will never ask for it.
3. Treat a new-device sign-in during an inbound call as a strong fraud signal, where you can see it.
4. Throttle repeated code requests and alert the customer in-app.
5. Audit contact-center scripts for any step that asks a customer to read out a code.
6. Prepare controls for authorized-payment scams, which strong authentication doesn’t stop.

Ticks stay in your browser only and are not saved.

Print this checklist Clear ticks