One-Time Passwords

One-Time Passwords are temporary, single-use codes generated by a system or device to provide an additional layer of security during the authentication process. They are commonly used in two-factor authentication to ensure that a password alone is not enough to access an account.

However, traditional OTPs sent via SMS are vulnerable to interception and phishing. More secure versions, such as Time-based One-Time Passwords, are generated locally on a device using a shared secret and the current time, making them immune to interception during transmission.

While better than SMS, they are still susceptible to sophisticated phishing attacks that capture the code in real-time. FIDO2 standards provide a superior alternative by using cryptographic challenges that cannot be phished or intercepted.

OTPs remain a widely used, though increasingly legacy, security measure in many financial applications.