#OTP security

If you've been using online services employing layers of security such as online banking or credit card transactions, then you might have already encountered the OTP or One-Time PIN. The OTP is a set of numbers sent to a user, usually to his or her phone number or email, that is needed to validate access or a transaction, which minimizes the risk of fraud. As an example, the Bank of the Philippine Islands (BPI) uses OTP and sends their clients a unique 6-digit password when they make critical or highly sensitive online transactions. The OTP is sent to the client's registered mobile number via SMS and will expire 5 minutes after it was sent. Do note that BPI OTP is a free service and you do not need to enroll or register for OTP. The rule is that the OTP is for you and you alone, meaning you're the only one who should receive it and you should NEVER share it with anyone. Exposing it to other users defeats the purpose of the OTP. Although OTPs are proven to be effective in minimizing fraud, attackers can still exploit it by using phishing and vishing methods directed to the user. Read more in our articles including "What is OTP and why you should never share it with anyone" and "Security Bank now sends SMS on ATM transactions".