One-time passwords and account takeover

Almost every account takeover reported to the police turns on a single moment — the victim reads out a one-time password to someone who asked for it.

The rule

No bank, no telecommunications company, and no police officer will ever ask you for a one-time password. Anyone who asks is committing fraud, whatever name or office they claim.

This holds regardless of how convincing the caller is, what they already know about you, or what number appears on your screen. Caller identification can be forged, and personal details are often obtained in advance precisely to make the call credible.

What the fraudster is doing

The code you receive is generated because someone is attempting a transaction or a password reset on your account at that exact moment. The call exists only to obtain it before it expires. The urgency in the caller's voice is a function of that time limit.

If you have given out a code

• Contact your bank immediately and ask for the account to be restricted.
• Change the password, and enable an additional authentication factor if available.
• Preserve the number that called, the time, and any transaction references.
• Report at your nearest division or to the appropriate specialist unit.

The window in which a transfer can be stopped is measured in hours. Reporting quickly is the single most useful thing you can do.