While confusion between romance slang and security alerts seems harmless, the real-world misuse of security verification codes carries severe financial consequences. Over the past three years, criminal networks have mechanized OTP theft through automated voice-calling services known as OTP bots.
These attack frameworks function through direct social engineering. A bad actor initiates an unauthorized login attempt using previously breached account passwords. When the bank dispatches a six-digit verification code to the victim's smartphone, an automated bot dials the victim, impersonating the bank's fraud detection division. The bot prompts the victim to enter the code via touch-tone keypad to "prevent unauthorized spending."
Once entered, the bot instantly relays that numeric token back to the attacker, who finalizes account takeover within seconds. Telecommunications carriers and financial institutions repeatedly remind consumers that authentic fraud units never contact customers to demand an inbound code over a phone call.
