Most financial fraud does not defeat a bank’s security. It persuades the customer to open the door.
The Central Bank of Egypt has warned customers against sharing their One-Time Password with anyone, cautioning "bank customers and users against sharing their One-Time Password (OTP) with anyone", as reported by Egypt Independent.
It reads like routine advice. It is the single most important sentence a bank customer can internalise, and the reason is structural.
What an OTP actually is
Modern banking security rests on two factors: something you know (your password or PIN) and something you have (your phone, which receives the code). The second factor exists precisely because the first can be stolen — through a data breach, a phishing page, or a reused password.
The OTP is the "something you have". When you read it aloud to someone, you have handed over the factor that was protecting you after the other one already failed. From the bank’s side, the transaction that follows is indistinguishable from one you performed yourself, because by every technical measure available, you did.
How the call actually goes
The pattern is consistent enough to recognise, and it does not sound like a scam while it is happening:
- Authority. The caller identifies as the bank’s fraud department, a card services team, or a delivery or utility company.
- Urgency. There is a suspicious transaction, an expiring card, a package that cannot be delivered. Something must be resolved now.
- Plausible knowledge. They may already know your name, your bank, sometimes the last digits of a card — from a breach, a leaked list, or a public source. This is what makes the call credible.
- The ask. "We have sent a verification code to confirm your identity. Please read it back."
At that final step the caller is not verifying you. They are on the bank’s website attempting a transaction, and the code just sent to your phone is the one thing they cannot obtain without your help.
The rule that removes the judgement call
A bank will never ask you to read an OTP to a person. Not the fraud team, not in an emergency, not to verify anything. This is not a guideline about suspicious calls; it is a rule about all calls, and its value is that it requires no judgement in the moment — which matters, because the whole method is designed to compromise your judgement.
If a caller claims to be your bank, end the call and dial the number printed on your card. Never call back a number the caller provides.
If you have already shared one
- Call the bank immediately on the number from your card, and say a code was shared.
- Ask for the card or account to be frozen rather than waiting to see whether anything happens.
- Change the online banking password, and anywhere else that password was used.
- Report it. Speed matters more than embarrassment — a transaction flagged within minutes has a materially better chance of being stopped.
Why this is a national issue, not a personal one
As banking moves onto phones across Egypt, a large number of people are using digital financial services for the first time, and first-time users are the most exposed to exactly this method. Financial-inclusion progress is real and worth having; it also widens the population a fraud campaign can reach. The World Bank tracks financial-inclusion indicators for Egypt, and the security education has to scale with the adoption or the gains get taxed by fraud.
Why SMS is the weak link, and what is stronger
It is worth understanding why this fraud persists despite being well known. The code arrives by SMS, and SMS was never designed as a security channel. It can be intercepted — and in a SIM-swap attack a fraudster persuades a mobile operator to move a victim’s number to a new SIM, after which the codes arrive on the attacker’s phone with no participation from the victim at all.
That is the scenario the "never share your code" rule cannot cover, and it is why stronger options exist:
- In-app approval. The bank’s own application prompts you to approve a transaction, showing the amount and the merchant. Nothing is read aloud, so there is nothing to repeat to a caller.
- Authenticator apps. Codes generated on the device itself and never transmitted, so there is no message to intercept.
- Transaction alerts. Not prevention but detection — and detection within minutes is what makes a reversal possible at all.
If your bank offers in-app approval, it is meaningfully safer than SMS codes and worth the few minutes it takes to switch.
Frequently asked questions
What is an OTP?
A One-Time Password: a short code sent to your phone to authorise a single transaction or login. It is the "something you have" factor that protects you when your password has already been compromised.
Will my bank ever ask for my OTP?
No. No bank, including its fraud department, will ask you to read an OTP to a person for any reason.
What should I do if someone asks for my OTP?
End the call. Then telephone your bank using the number printed on your card — never a number the caller gives you.
I already shared a code. What now?
Call your bank immediately on the number from your card, ask for the account or card to be frozen, and change your online banking password. Report it quickly; minutes matter.
