No. 07Week of September 23, 2026This week’s briefing
Tradecraft

Explainer

Why OTP bots keep working against bank customers

Automated calls that impersonate a bank get customers to hand over one-time passcodes in real time. The weakness is the code itself.

By Published 1 min read

For Fraud & risk Product & payments

The short answer

What is an OTP bot?

An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.

If you read nothing else

  1. OTP bots automate the social-engineering call that used to need a human.
  2. They work because a one-time code can be used by whoever has it.
  3. Phishing-resistant methods remove the code the bot asks for.

How an OTP bot attack works

  1. The criminal already has the victim’s username and password, usually from a breach or a phishing page.
  2. They start a login or payment, which makes the bank send the victim a one-time passcode.
  3. At the same moment, the bot calls the victim, claims to be the bank’s fraud team, and asks them to “confirm” the code they just received.
  4. The victim reads it out or types it into the keypad, and the bot passes it straight to the criminal.

Why it keeps working

The call arrives exactly when the real code does, which makes it convincing. And a one-time passcode has no way of knowing who is typing it in or where: it works for anyone who has it within its validity window.[1]

What stops it

  • Remove the code: passkeys, in-app approval on a registered device and network-based verification leave the customer nothing to read out.
  • Put context in the message: if a code is unavoidable, say what it approves (“to add payee J. Smith”) and that the bank will never ask for it.
  • Watch the timing: a login from a new device while the customer is on an inbound call is a strong fraud signal.

Sources

  1. BankInfoSecurity One-time passcodes are gateway for financial fraud attacks (2026-04-03)

Changelog

  • : Published.

Cite this

Tradecraft. “Why OTP bots keep working against bank customers.” Tradecraft, September 1, 2026. https://glide-tradecraft.pages.dev/explainers/otp-bots-explained/

Terms in this piece