A one-time password is the last thing standing between somebody else and your money. Everything else about your account can be discovered, guessed or bought in a data breach. The OTP is generated fresh, sent to you, and useless to an attacker unless you hand it over.
There is no legitimate reason for anyone to ask you for one. None. Not your bank, not the police, not a courier, not your mobile operator, not a shop, not a government department. If you take one thing from this site, take that sentence.
Every version of the request is fraud
The approach is always dressed up as something reasonable, and the framing changes constantly. The underlying request does not.
| What they say | What it is |
|---|---|
| “To verify your identity” | Fraud. Verification never requires you to read an OTP to a person. |
| “To cancel the transaction you did not make” | Fraud. The OTP authorises a transaction; it never cancels one. |
| “Just the last three digits” | Fraud. The partial framing exists to sound reasonable. It is a known technique. |
| “To confirm the delivery of your parcel” | Fraud. Couriers do not need an OTP from your bank or your phone. |
| “To reverse the payment that came in by mistake” | Fraud, and usually the start of a money-muling attempt. |
| “We are from the fraud department” | Fraud. A real fraud department blocks the account; it does not need your OTP. |
What to do when it happens
- Do not read out any part of it. End the call. You do not owe a caller politeness, and a genuine organisation will not mind.
- Read the message itself, not the caller’s summary of it. An OTP message states what it authorises and for how much. That text is frequently the moment people realise what is happening.
- Phone your bank on the number printed on your card, not a number the caller gave you and not one from a search result.
- If you did share one, phone the bank immediately. Speed is everything: a transaction stopped in minutes is recoverable in a way that one reported the next morning is not.
- Open a police case and get the case number. Every later step, including any claim, depends on one existing.
SIM swap: when the OTP stops reaching you
A SIM swap transfers your number to an attacker’s SIM, after which your one-time passwords go to them and you never see the request at all. It is usually preceded by attempts to gather your personal details, which is what fake verification calls are for.
- Sudden and unexplained loss of signal is the warning sign, particularly where other phones nearby are working. Treat it as urgent rather than as a network fault.
- Phone your mobile operator from another handset immediately, then your bank.
- Use app-based authentication rather than SMS where it is offered. An authenticator app is not affected by a SIM swap.
- Ask your bank what additional verification it offers, because most now provide something beyond SMS.
- Register a Protective Registration with SAFPS on 011 867 2234 if your identity documents were involved. It is free.
Why we say this on a contact directory
Because the number people phone is where this fraud starts. A fraudulent contact number placed where somebody will search for it is a complete attack on its own: the victim makes the call, believes they have reached their bank, and hands over the OTP to a person they phoned themselves. Nothing has to be hacked.
That is the reason this directory publishes only what it can verify against an organisation’s own official source, and publishes nothing where it cannot. An unverified number is not a lesser version of a verified one. It is the mechanism of the fraud.
Questions people actually ask
The caller knew my ID number and my last transaction. Surely that is proof?
It is proof of nothing except that your details have been breached somewhere, which is true of most South Africans. Account numbers, addresses, identity numbers and transaction histories circulate widely and are used precisely to establish credibility. The only reliable test is to end the call and dial the number on your card.
I gave the OTP. How long do I have?
Minutes, realistically. Phone your bank immediately on the number printed on your card and say clearly that you disclosed a one-time password and believe a fraudulent transaction is in progress. Banks can sometimes stop or recall a payment that is still in flight. The same call the next morning is usually too late.
Can my bank refuse to refund me?
It can, and frequently does where a customer disclosed authentication details, because the transaction was technically authorised. That is exactly why the rule matters. If you are dissatisfied with the outcome, the National Financial Ombud on 0860 800 900 reviews banking complaints free of charge, and it will want the case number and the correspondence.
What about an OTP for a delivery or a collection?
Some couriers and retailers do use collection codes, and those are not bank OTPs. Read the message: it will say what it is for. A code that says it authorises a payment or a change to your account is never a delivery code, whatever the person at the door claims.