These are passwords generated for one-time use and/or sent to the cardholder's mobile phone to verify card transactions in payment systems. The password sent to your phone by the bank during a 3D Secure transaction is an example of this. OTP is also used to verify transactions in mobile payments.
Since OTP verification works by sending a system-generated password to the user's mobile phone, it makes a significant contribution to reducing fraud cases.
How Is an OTP Generated?
An OTP can be generated using different methods:
- Password sent via SMS: The bank's system generates a random password and sends it to the cardholder's registered phone number.
- Time-based password: A mobile app or hardware device generates a password that changes at regular intervals. The password is calculated using a secret key on the device and the current time.
- Event-based password: A new password is generated by incrementing a counter each time it is used.
Weaknesses of SMS OTP
Although passwords sent via SMS are widely used, they are exposed to certain risks. For example, fraudsters may call the cardholder and try to persuade them to share the password they received by phone. There is also the risk of SMS messages being intercepted through SIM card cloning or SIM swapping.
Current Methods
Because of these risks, banks also use methods such as in-app notification approval, fingerprint recognition, or facial recognition alongside SMS OTP.
Security Recommendations
- Never share the password sent to your phone with anyone who asks for it by phone or message, under any circumstances. Banks never ask customers for this password.
- Compare the merchant name and amount stated in the password message with the transaction you actually made.
