Secordit home
Contact

What is a one-time password?

Banks and other services often ask for a one-time password, also called a one-time passcode or a 2SV code. It is a short-lived extra sign-in or payment check, meant to be used once. This page explains the method. The OTP scam page covers requests to read a code out or forward it. 123

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. The service sends or displays a code in an authenticator app, by text or email, or on a hardware token. 13
  2. You enter that code to confirm a sign-in or a payment. It should work only once, or only for a short time. 23
  3. The NCSC ranks app-based or device-based methods above codes sent by text or email, because SMS and email codes can be intercepted or phished. 1

How it can look

The NCSC's consumer 2SV guidance describes a PIN or code, often sent by SMS or email, as one way to add a second check. Its organisation guidance on MFA types ranks app-based one-time passwords above message-based codes. If a caller asks you to read a code out, that is a warning sign, not a normal bank process. Use the OTP scam page for that situation. 31

Warning signs

  • A caller, text or message asks you to read out or forward a code, even if they sound like your bank or a colleague. 13
  • A code arrives that you did not request. 23
  • A service offers only a text-message code when an authenticator app or a passkey is also available. 1

What to do now

  1. Use an authenticator app or a device-based method where the service offers one, rather than relying only on a text or email code. 12
  2. Never give an OTP to someone who calls, texts or messages you, even if they sound like your bank or a colleague. 13
  3. If you have already shared a code, sign in through the genuine site or app, follow the account-recovery steps, and see the OTP scam page. 2

UK reporting and support

  • If you think an account has been taken over, follow the NCSC help for a hacked account. 4
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 578
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 6
  • If someone is in danger, call 999. 78

How to protect yourself

  • Prefer a passkey or an authenticator app over a code sent by text or email, where you have the choice. 1
  • Keep your phone number and email account protected, because those channels can be used to receive codes. 13
  • Treat every request to share a code as suspicious, and use a contact method you already trust to check. 1

Frequently asked questions

Why does my bank send me a one-time password, and should I ever read it out to a caller?

The bank is using the code as an extra sign-in or payment check. You should never read it out or forward it to someone who contacts you, even if they sound like the bank. If that has already happened, use the OTP scam page and contact the bank on a number you already trust. 31

Is a one-time password the same as a one-time passcode scam?

No. This page explains the genuine method. The live OTP scam page covers what to do if someone tricks you into sharing a code. The two pages are meant to be read together, not merged. 13

Are all one-time passwords equally strong?

No. The NCSC ranks app-based or device-based methods above codes sent by text or email, because SMS and email codes can be intercepted or phished. 1

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Recommended types of MFA | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Setting up 2-Step Verification (2SV) | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).