Why You Should Never Share an OTP — Even With "Your Bank"

KYC scams, government scheme fraud, the "guess who" WhatsApp scam, fake parcel calls — nearly every major scam covered in this series converges on the same final request: share an OTP. This isn't a coincidence. It's because the OTP is the actual lock, and everything before it is just getting you to the door.

What an OTP is actually for

A one-time password exists specifically to confirm that the person completing a transaction or login is the same person who owns the account — a second factor beyond a password or PIN. It's sent directly to you because you're meant to be the only one who sees it.

Why sharing it is almost always the point of no return

Once an OTP is shared, whatever action it was generated for — a login, a UPI payment, a card transaction, an account recovery — goes through, and there's typically no undo button on the other side. This is different from, say, sharing your name or even your Aadhaar number, which alone usually isn't enough to complete a financial transaction. An OTP is often the single missing piece a scammer needs.

The legitimate scenarios, and why they don't require sharing

• Your bank sends an OTP to confirm a transaction — it's meant to be entered by you, into the bank's own app or website, never read aloud to a caller or typed into a message.
• A delivery service sends an OTP to confirm receipt of a parcel at your door — again, entered by you directly, never shared over a call.
• No government agency, bank, telecom provider, or delivery service has a legitimate process that requires you to read an OTP to someone else.

The specific phrasing to watch for

• "Read out the OTP you just received to verify your identity."
• "An OTP was sent to your number by mistake — please forward it."
• "Enter this OTP on the link we sent to complete your KYC/refund/verification."

Every version of this request, regardless of who's asking or how the conversation started, means the same thing: stop.

If you've already shared one

Check your bank account and any linked apps immediately for unauthorized activity. If a transaction has already gone through, call 1930 right away — see The First Hour After Sending Money to a Scammer for exactly what to do next. Change your banking password and PIN from a secure device regardless of whether money moved, since the same access could be attempted again.

If you want to understand how a scammer got convincing enough to reach this point with you in the first place, How Scammers Build a Convincing Profile of You covers where that credibility usually comes from. This is one entry in our running field guide to what's actually circulating right now — see Common Scams in India Right Now (2026) for the rest.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.