How OTP Verification Actually Works (and Where It Fails)

Your phone buzzes with a six-digit code, you type it into an app, and a payment goes through. That tiny number just did more security work in three seconds than most passwords manage in a year. But the same code is also the weak point scammers chase hardest, and understanding why tells you a lot about how fragile this system really is.

What an OTP is actually doing

OTP stands for one-time password, a short code that works exactly once and expires fast. Underneath, there are two flavours. HOTP (HMAC-based One-Time Password) generates a new code every time a counter ticks forward, so each login or transaction bumps the counter and produces a fresh value. TOTP (Time-based One-Time Password) does the same thing but ties the code to the clock instead of a counter, typically refreshing every 30 seconds — this is how apps like Google Authenticator work.

Both rely on a secret key that only your device and the server know, run through a one-way mathematical function (a hash) that's easy to compute forward but practically impossible to reverse. Feed in the secret plus the time or counter, out comes a code nobody could have predicted without that same secret. That's the whole trick: a number that looks random but is independently verifiable by both sides.

Why Indian banks and UPI apps lean on this so hard

India didn't adopt OTPs by accident. The Reserve Bank of India has mandated an Additional Factor of Authentication, a second check beyond just a card number or password, for card-not-present transactions since 2009. When UPI arrived, that same philosophy carried over, and OTP became the default way to prove "yes, this is really me" for a huge share of the country's digital payments. With India running the largest real-time payments volume in the world, that single six-digit code is doing authentication duty at a scale almost no other country's banking system attempts.

A password proves you know something. An OTP is supposed to prove you still have something, your phone, right now. The moment that assumption breaks, so does the security.

Where the whole system falls apart

The OTP model assumes the code reaches only you, and that's exactly the assumption fraudsters attack. A few of the common failure modes:

• SIM swap fraud, where a scammer convinces your telecom operator to reissue your number on a new SIM they control, so your OTPs land in their hands instead. We've covered how SIM swap fraud actually works in detail.
• Vishing (voice phishing), where someone calls pretending to be from your bank or a delivery service and simply asks you to read out the code you just received, usually under time pressure.
• SS7 attacks, which exploit old weaknesses in the telecom signalling network (the system that routes calls and texts between carriers) to intercept SMS messages in transit, no SIM swap required.
• OTP bots, automated services that call victims with a convincing recorded voice claiming to be their bank, tricking them into entering the OTP on a keypad that feeds straight to the attacker.

Notice that none of these break the math behind HOTP or TOTP. The cryptography holds up fine. What fails is the delivery channel and the human on the other end, which is exactly why banks keep reminding customers that no legitimate representative will ever ask for an OTP over the phone.

What's slowly replacing SMS OTPs

App-based TOTP, the kind generated locally by an authenticator app rather than sent over SMS, sidesteps SIM swap and SS7 risks entirely because there's no telecom network in the loop at all. NPCI has also pushed UPI toward device-binding and biometric checks, letting some transactions clear with a fingerprint or face scan instead of a PIN. And passkeys, a newer login method that replaces passwords and codes with a cryptographic key stored on your device, are starting to show up as an alternative for account logins, which we've explained in more depth separately. None of these fully retire the OTP yet, but they chip away at the one piece scammers actually exploit: the SMS pipe.

For now, the practical rule hasn't changed much in fifteen years: treat an OTP like a physical key, not a piece of information you share to be helpful. If anyone, including someone who sounds exactly like your bank, asks you to read one aloud or forward it, that request itself is the fraud attempt. The code was never meant to leave your screen.