0

I just called a number that I thought was my bank's and reached a customer service representative that asked me to verbally read to them a one-time passcode that was texted to my phone.

Is this standard practice?

I can't imagine anybody but a scammer asking me to read them an OTP I received. Seems much more likely to be somebody trying to reset my password while I'm on the phone with them. This isn't commonplace...right?

4
  • You have already determined that this is a problem, but you do not explain why. What is the issue here? If it was a TOTP code generated from an app, that would be one thing, but what's wrong with a texted code? Was the code sent after you called or before?
    – schroeder
    Commented Mar 28, 2023 at 5:15
  • @schroeder The texted code isn't a problem. But reading off any password, including OTPs, to another person is a problem. Passwords are designed for humans to interact with machine systems, and any human in the middle seems a pretty big risk. Commented Mar 28, 2023 at 14:00
  • That's not what passwords are "for". And less so for OTP. This is a perfectly fine use case for OTPs. Passwords and OTP are a "shared secret". This process ensures that the bank is talking to a person who has possession of phone number registered with the account.
    – schroeder
    Commented Mar 28, 2023 at 18:33
  • Happened to me when I left a company, they needed to do a password reset, and my private phone was registered to receive OTPs. They called me to make sure I was on the phone, started the password reset, that sent an OTP to my phone which I read out, they finished the password reset and changed the device receiving the OTP.
    – gnasher729
    Commented Dec 25, 2023 at 20:35

2 Answers 2

1

There are scams where criminals contact you, trigger a transaction, then ask you to read back the OTP code. That would enable the criminal to complete the transaction. But that's not the situation here.

You called customer service, and for them to ensure that it is you (to protect your account), they sent a OTP to your registered phone number and asked you what they sent. This is standard practice for some banks.

What you need to be sure of is:

  • you actually called your bank and not a scammer
  • the OTP code isn't associated with a transaction, which the SMS text will mention

But otherwise, this is normal practice for some banks.

-3

It is a problem and more than just unsafe.

If a scammer got far enough into your bank account to be asked for a verification code then your account is still safe.

So what the scammer can try: Get in contact with you, contact the bank which will send you a verification code for your account, and if you read it to the scammer, that’s the missing bit to your account that they need so now they can break in.

Don’t read these numbers over the phone. There is no way a genuine bank employee could verify that code, so it is a hacker.

2
  • "There is no way a genuine bank employee could verify that code" -- actually this is a normal procedure for a bunch of banks. So, this answer is wrong.
    – schroeder
    Commented Mar 28, 2023 at 18:36
  • It is possible for the bank employee to verify the code, that's why they have access to the backend systems on their computers.
    – ThoriumBR
    Commented Apr 27, 2023 at 20:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .