One-Time Password (OTP)
A one-time password (OTP) is a code that is valid for a single sign-in or transaction, either generated by an authenticator from a shared secret, as in HOTP (RFC 4226, counter-based) and TOTP (RFC 6238, time-based with a 30-second default step), or sent by the service over SMS, voice or email.
NIST SP 800-63B-4 states plainly that "OTP authentication is not phishing-resistant", because a code a person reads can be typed into a fake page and relayed before it expires. SMS and voice delivery add their own weaknesses, SIM swap and number porting among them, and NIST treats the phone network as a "restricted" authenticator that verifiers should only use after checking signals such as a recent SIM change. Both problems are live: the InsureOTP kit in July 2026 asked insurance customers for their OTP "as routine identity verification" and relayed it to the real portal, and Microsoft Entra ID stops delivering its own SMS and voice codes on February 1, 2027.
See also: HOTP, TOTP, OTP relay social engineering, two-factor authentication, phishing-resistant MFA
Related on Start with Identity
- GlossaryCalling Name Presentation (CNAP)
Calling Name Presentation (CNAP) is a telephone network service that shows the called user the caller's name, supplied by the network rather than by the caller,
- GlossaryMFA
Multi-Factor Authentication. Requiring two or more factors from distinct categories: something you know (password), something you have (token), something you ar
- GlossaryJust-in-Time (JIT) Access
Granting elevated permissions only when needed, for a limited duration, and revoking them automatically. JIT eliminates standing privilege, the largest contribu
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.
- CVEVault TOTP login MFA bypass
Vault's TOTP login MFA could be bypassed. Companion to the LDAP MFA bypass in the VaultFault set. Confirm the score against NVD; vendor and researcher figures c
- Blog1.6 million RingCentral records leaked, and the entry point was one phone call
ShinyHunters voice-phished a RingCentral employee out of their password in July, took 623GB, and dumped 280GB after the company refused to pay. Have I Been Pwne