Every bank, app and government portal sends OTPs. The one-line truth about them is simple: an OTP proves that a particular phone received a message for a few seconds — nothing more.
What an OTP actually proves
It is a one-time credential tied to possession of the SIM that received it. It authenticates the transaction, not the human. That is why "OTP verification" can never confirm who you are, and nobody legitimate ever needs you to "tell them" the OTP — they already control the process.
Why it matters
- The code is tied to the SIM, not to you — sharing it hands over authorisation.
- Legitimate institutions never ask you to read your OTP back; they enter it themselves on their end.
- OTP sharing is the common thread in almost every account-takeover fraud.
Key takeaways
- OTP = possession of a phone for moments, not identity.
- Nobody legitimate asks you to read your OTP aloud.
- Sharing one hands over authorisation — full stop.
Why fraudsters beg for it
They want to complete an action on your behalf — reset a password, authorise a transfer, register a new device. The moment you share an OTP, you hand them the authorisation. Acting fast is the whole trick: the code expires, so they push urgency.
What you should do
- Never share an OTP in a call, message or form, whatever the urgency.
- If you accidentally shared one, assume that account is compromised: change the password and tell your bank.
- Report identity fraud to cybercrime.gov.in.