OTP (One-Time Password)

A one-time password, or OTP, is a short code that works once and then expires. It is sent to something the customer already holds, such as a phone or an app, and typed in to prove the person is who they claim to be. Because each code dies after use, a stolen one is worth little a few minutes later. That is the whole design idea. In payments, an OTP is one of the common ways a bank checks a shopper during an online purchase or a login.

The method spread because it solves a narrow problem well. A password alone is a single secret that can be reused, guessed or stolen in bulk. Adding a code sent to a device turns one factor into two: something known and something held. Payment rules in the UK and the EU lean on that split. The technical standards on strong authentication say an authentication code may be accepted only once, and that a new code cannot be worked out from an old one. Article 4 of those standards sets out both points.

How An OTP Is Generated

Two broad families. A time based code comes from a shared secret plus the clock, so the app and the server work out the same value without talking. That is what an authenticator app does. A sent code is created by the server and delivered over a channel: a text message, a push alert, an email or a voice call. Time based codes need no network at the moment of use. Sent codes need a working delivery path, which is where most real world failures start.

Where It Fits In A Payment

Most shoppers meet an OTP through 3D Secure. The shop sends the payment for a check, the bank decides whether to challenge, and if it does the customer sees a code prompt. A pass adds a signal to the request that the bank checked the holder. That signal usually shifts liability for fraud towards the issuer, though rules vary by network and are updated from time to time. It is one of several tools under strong customer authentication, sitting beside biometrics and app approvals.

OTP Set Beside Other Factors

An OTP counts as possession: proof of holding a device. A password or PIN counts as knowledge. A fingerprint or face match counts as an inherent trait. Two-factor authentication needs two of the three, from different categories. So a password plus an OTP qualifies, while two passwords do not. Knowledge based authentication, which asks about past addresses or accounts, sits in the knowledge bucket too, and has fallen out of favour as personal data has become easier to look up.

Known Weaknesses

An OTP is not a strong link in every chain. Text delivery can be intercepted, and a number can be moved to a new SIM by someone posing as the owner. Phishing sites can ask for a code in real time and pass it straight on. NIST's guidance on digital identity authenticators treats authentication over the public telephone network as restricted, and asks for extra checks where it is used. None of that makes OTPs useless. It does mean they belong in a layered setup rather than standing alone, especially where account takeover is a live risk.

Delivery Problems That Cost Sales

The commercial cost of an OTP is usually not fraud. It is drop-off. A code that takes 30 seconds to arrive loses shoppers who assume the payment failed. Roaming customers may not receive texts at all. Long codes get mistyped, and a code that arrives after the page has timed out is worse than no code. Every extra second here reads as friction, which is why teams measure challenge completion as closely as they measure approvals.

Doing It Well

A few habits help a lot. Keep the code short and numeric, and let the phone autofill it where the platform allows. Show a clear timer and an obvious resend, with a sensible cool-off. Name the shop in the message so the customer knows what they are approving. Allow a fallback method rather than trapping someone whose phone is out of signal. And do not challenge where a check is not needed: pairing OTPs with the right SCA exemption strategy keeps the step for cases that warrant it. This guide to 3D Secure and online payment fraud covers the flow in detail.

Where The Method Is Heading

Passkeys and in-app approvals are taking over parts of the job. They keep the two factor split while removing the typed code, which removes the phishing step and much of the delay. Bank apps increasingly ask for a tap and a fingerprint instead of sending a text. OTPs are likely to stay for a while as a fallback, since not every customer has a smartphone or a working app. Treating them as the backup rather than the default is where many teams are now heading. This look at smart 3D Secure and fewer declines sets out how the choice is made per payment, and fraud detection tooling tooling is one input into deciding when a challenge is worth it.

‍