OTPs and PINs: nobody legitimate will ask for them
An OTP (one-time password) is a short code sent to your phone to confirm a login or payment. Your PIN and password protect your account. If a scammer gets one of these at the right moment, they can empty your account while you are on the phone with them.
The one rule
Never share an OTP, PIN or password with anyone. Not with a caller, a chat agent, a delivery rider, “support staff” or someone who says they are from your bank. Real staff will never ask for them, because they do not need them.
How scammers get them
- “Your account will be blocked, read me the code.” They start a login or payment, the code reaches you, and they ask you to read it out.
- “I sent a code by mistake.” A stranger asks you to forward a code you just received.
- Fake login pages. A link leads to a copy of your bank or e-wallet and collects everything you type, including the code.
- Screen-sharing or remote-control apps. Someone talks you into installing one “for verification”, then watches your screen.
- A “relative” or “friend” in trouble who asks you to confirm something with a code.
What to do
- If a call or message asks for a code, stop. Hang up or close the chat.
- Open your bank or e-wallet app yourself, or call the number on your card, and ask whether anything is wrong.
- Turn on notifications for every transaction, and set sensible transaction limits if your app allows it.
- Never install an app because a caller told you to.
If you already shared a code
Time matters. Contact your bank or e-wallet immediately through its official app or hotline and ask them to block or secure the account. Then change your passwords and follow what to do right after you’ve been scammed.
Last reviewed 17 Oct 2026.