One-Time Password (OTP)
A one-time password (OTP) is a code that is valid for a single sign-in or transaction, either generated by an authenticator from a shared secret, as in HOTP (RFC 4226, counter-based) and TOTP (RFC 6238, time-based with a 30-second default step), or sent by the service over SMS, voice or email.
NIST SP 800-63B-4 states plainly that "OTP authentication is not phishing-resistant", because a code a person reads can be typed into a fake page and relayed before it expires. SMS and voice delivery add their own weaknesses, SIM swap and number porting among them, and NIST treats the phone network as a "restricted" authenticator that verifiers should only use after checking signals such as a recent SIM change. Both problems are live: the InsureOTP kit in July 2026 asked insurance customers for their OTP "as routine identity verification" and relayed it to the real portal, and Microsoft Entra ID stops delivering its own SMS and voice codes on February 1, 2027.
See also: HOTP, TOTP, OTP relay social engineering, two-factor authentication, phishing-resistant MFA
Related on Start with Identity
- GlossaryCalling Name Presentation (CNAP)
Calling Name Presentation (CNAP) is a telephone network service that shows the called user the caller's name, supplied by the network rather than by the caller,
- GlossaryMFA
MFA (multi-factor authentication) is sign-in that requires two or more factors from different categories: something you know (a password or PIN), something you
- GlossaryJust-in-Time (JIT) Access
Granting elevated permissions only when needed, for a limited duration, and revoking them automatically. JIT eliminates [standing privilege](/glossary/standing-
- CVEVault login MFA rate-limit bypass and TOTP reuse
Vault's login MFA rate limits could be bypassed and TOTP codes reused, weakening the second factor. Part of the 2025 VaultFault set with the LDAP MFA bypass in
- CVEVault TOTP and LDAP EntityID reuse
Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.
- Blog1.6 million RingCentral records leaked, and the entry point was one phone call
ShinyHunters voice-phished a RingCentral employee out of their password in July, took 623GB, and dumped 280GB after the company refused to pay. Have I Been Pwne