Overview
The victim expects to be performing a task that requires that they send a special code sent through SMS or email.
How It Works
This technique is used by scammers in situations where they are trying to get access to a service where an existing phone number is needed (e.g. signing up for a new Google Voice number) or where the scammer needs an OTP code sent to a victim's device in order to take over an account.
The scam plays on the victim's instinct to help out, to get an upgrade of some sort, or to communicate with someone who wants to prove the victim's legitimacy.
The scammer will typically reach out to the victim in a cold call fashion with a message such as "Hello, this is __. I accidentally sent my OTP to your number." or "Hi, this is tech support. We're upgrading your SIM. Send your Aadhaar and OTP to continue."
Sometimes the scammer will reply to something the victim posted online, such as having lost a pet. "I have your cat, but in order to make sure you're real I'm going to send you a 6 digit code first". The code the scammer sends is in reality the OTP code from whatever service the scammer is trying to compromise.
Regardless of the ruse used by the scammer, when the victim replies with the code, this is what is needed to allow the scammer to accomplish the scam, such as an account takeover or account creation.
Related Articles
All You Need to Know About One Time Password Scams, SRI Federal Credit Union
The Verification Code Scam, Computer Tutor Florida
Synthetic Examples
2.2.5 Sample Data 1 - count: 400.
2.2.5 Sample Data 2 - count: 321.
Related Scams
2.1.2 Online Marketplace Scam Buyers: OTP scams will sometimes use the "fake buyer" pretext as the mechanism to begin the OTP scam
2.2.8 Lost Pet Scam: OTP scams often use the "lost pet" pretext to begin the OTP scam
2.2.10 Account Upgrade Scam: OTP scams sometimes use an "account upgrade" as the pretext to begin the OTP scam
Related Crime Schemes
A particular instance of this scam may embed one or more of these related schemes.
Data Loss or Theft: Any scheme that results in victim losing data/scammer stealing data. Data in this context can mean login credentials, credit card details, or other personal or corporate information.
Victim Targeting Context
The scammer may use one or more of the following techniques to reach the victim.
Spray and Pray / Scattered: The scammer approaches many victims at once such as through bulk email or SMS.
Targeted Conversational Approach: The scammer approaches the victim through targeted, topical online conversation.
Social Engineering: Psychological Manipulations
The scammer may use one or more of these psychological techniques to accomplish the scam.
Accident: The scammer contacts the victim under the guise of an accident (such as a wrong number), so as to lower suspicion.
Authority: The scammer employs an abuse of a position of authority to convince the victim to go along with the scam.
Codes or Jargon: The scammer uses official-looking codes or technical jargon as part of the scam to increase appearance of legitimacy or to confuse the victim.
Easy Money: The scammer promises easy money or makes appeals designed to leverage victim's greed.
Nice Guy: The scammer takes advantage of the victim's generosity or attempt to be "a nice guy".
Urgency: The scammer employs urgency to increase the likelihood that the victim will take action.
Social Engineering: Impersonation Techniques
The scammer may impersonate one or more of the following groups as part of the scam.
Business or NonProfit: The scammer impersonates a business or nonprofit.
Catfishing: The scammer creates a fictitious online profile or persona.
Technical Support / Tech: The scammer impersonates a technical support worker or tech company.