Your phone buzzes. A message or call says your bank account will be blocked unless you confirm a code immediately. Or someone pretending to be a supplier asks you to "send the code that just arrived" so they can complete a refund.
An OTP, a one-time PIN or password, is a short security code used to confirm access, payments or account changes. It is sent to your phone or generated in your banking app because only you should be able to complete that step.
Your OTP protects your money and accounts. If you disclose it to another person, you may be giving a scammer the final piece they need to log in, approve a payment or change your banking details.
What an OTP protects
Banks and payment apps use OTPs and approval notifications as a second check. The first check might be your password or PIN. The OTP confirms that the person trying to complete the action has access to your phone or registered device.
That is why scammers work hard to get your OTP. They may already have part of your login details from a phishing message or a data breach. The OTP is often the last gate before money moves or account settings change.
Definition
OTP (one-time PIN)
A short security code, usually sent by SMS or shown in a banking app, that confirms one specific action such as a login, payment or account change. It should be used only by the account holder and expires after use or after a short time.
A legitimate organisation will not ask you to read your OTP aloud on a call, send it by WhatsApp or type it into a website you did not open yourself through the official app.
How scammers create pressure
Scammers pretend to be people or organisations your business already trusts. They may claim to be your bank, a supplier, a customer, a delivery company, an insurer, a government office or technical support.
Their stories often involve a problem that needs fixing now: a blocked account, a failed payment, a delivery issue, a refund that requires verification or a security alert. The details sound specific enough to feel real. The urgency is deliberate.
Their goal is to make you act before you think. If you share the code or approve a request you did not start, they may transfer money, add a new beneficiary or lock you out of your own account.
The urgent call for a "verification code"
You receive a call from someone who says they are from your bank's fraud department. They tell you suspicious activity was detected on your business account and your account will be frozen within minutes unless you verify your identity.
They ask you to read out the OTP that was just sent to your phone. You comply because the caller sounds official and mentions your business name correctly.
Minutes later, you receive a notification that a payment was approved from your account. The caller was not from your bank.
What never to share
Your OTP is one part of a wider set of information scammers try to collect. Treat all of these as private, for you and anyone who helps with business admin or payments.
Do not share OTPs, banking passwords, app approval codes, card PINs, login details, recovery codes, screen-sharing access or remote access to your phone or computer. A person who can see your screen or control your device may complete payments without you realising.
Staff and family members who help with the business should understand the same rule. One shared code in a WhatsApp group can expose the whole account.
Check banking app approvals
Many banking apps send push notifications asking you to approve a login or payment. These appear on your phone even when you are not using the app.
If a notification arrives and you are not making a payment or logging in, do not approve it. Stop and check. Someone else may be trying to access your account and waiting for your approval to complete the step.
Open the banking app yourself, do not use a link from a message, and review recent activity. If you are unsure, call your bank using the number on your card or the bank's official website, not a number from the suspicious message.
Act quickly if you shared a code
If you shared an OTP, approved a request you did not start or gave someone remote access to your device, act immediately. Do not wait to see if money leaves the account.
Early action may help limit further loss. Recovery is not guaranteed, but delay often makes the situation worse.
A common mistake
The most common mistake is sharing an OTP because the caller sounds official or urgent. Scammers research businesses, use professional language and create time pressure on purpose. Your OTP is not a formality, it is the gate that stops unauthorised access.
Your next step
Tell everyone who handles business money or banking apps the same rule: if another person asks for an OTP, end the contact and check through an official channel.
Keep learning
The next topic helps you set clear WhatsApp rules for messages, payments and account access.
Many OTP scams start on WhatsApp or move there after an initial phone call. Strong WhatsApp habits reduce the chance that an urgent message leads to a shared code.