Why do People Share their OTP's?

OTP’s are an example of what is called 2FA (2-factor authentication), i.e., two independent steps to confirm something. Logging into the bank’s website isn’t safe enough – what if someone else stole your ID and password? And so the RBI mandated 2FA in 2008 – a second check, the OTP, would be sent to your registered mobile number. The odds that someone hacked your bank account (digital theft) and also got your phone (physical theft) were very low.

 

Banks send periodic reminders that one should never reveal the OTP, even to the bank. It is just something to be typed on the website. Yet, in The Art of Conjuring Alternate Realities, Shivam Shankar Singh and Anand Venkatanarayan point out that in Gurgaon, despite its well-off and educated population, OTP sharing by the victim is the most common mode of cyber-crimes. What is going on?

 

First, the authors point out that a large section of the population cannot differentiate between: (1) Public identifiers (name, phone number); (2) Private identifiers (debit card number); and (3) Secrets (OTP, CVV). So many don’t even understand that they shouldn’t be sharing the OTP.

 

Here’s how cybercriminal works. He has already hacked your account, but he needs the OTP to authorize the funds transfer.

 

In the first approach, he calls and threatens the target: your account will get locked due to KYC non-compliance, but you can fix the problem if you share the OTP just sent (which of course, was the OTP the bank sent for confirming the funds transfer)… This approach works best with relatively uneducated folks.

 

In the second approach, the caller plays to the victim’s greed. You are eligible to this reward or cash back, if you just share the OTP, the gift will be sent to you. This way works more with better off folks who are used to cash backs…

 

But there’s another reason why many people are confused about OTP’s. The humble OTP is used for so many different things today, not just bank transactions. And in many of those uses, one has to tell the OTP orally. To the delivery boy before he hands you the item from Amazon or Big Basket. Or to the Uber/Ola driver that you’re the one who booked the cab. There are even gyms that don’t issue I-cards – you just tell your phone number to the guard; he initiates an OTP to be sent; which you then read out to him - identify confirmed, he lets you in.

 

No wonder then many people truly don’t know when they should or shouldn’t share the OTP. And therein lies the opportunity for the cybercriminal.

 

OTP is an excellent security mechanism indeed. Unfortunately, it’s part of an endless cat and mouse game in the (cyber) world.

Comments

Post a Comment

Popular posts from this blog

Student of the Year

Image
As a toddler, my daughter loved Alia Bhatt’s songs, esp. the ones from Student of the Year . (That movie did have many good songs and well-choreographed dances). Fast forward to present day, when she is 12 yo. She rarely watches Hindi movies now, but one of the few ones she likes of late, Raja aur Rani ki Prem Kahani has, yes, Alia Bhatt.   If I had any hopes that there was anything to be read in the name of her toddler-time favorite ( Student of the Year ), they have been dashed. Our conversations come exam time are perfectly captured by this photo and its caption: In fact, the pic below captures how she and I look at her answer sheets – me intently, she with an expression of “It’s over, so why are you even looking at it?”   Of late, we pull her leg and tell her that she isn’t showing any signs of academic prowess, she’d better find a rich guy to marry. Some time later, she showed us this meme on the Internet: “Me No Study, Me No Care Me Go Marry Millionaire If He Die
Read more

Why we Deceive Ourselves

In their book, The Elephant in the Brain , the authors describe this weird aspect of deception that we practice: deceiving ourselves! That is so weird: “If our minds contain maps of our worlds, what good comes from having an inaccurate version of these maps?” The Sigmund Freud school of thought treats self-deception as a defense mechanism, “a way for the ego to protect itself”. The mind seeks to protect itself from anxiety and other negative emotions. Many object to this reasoning: since accurate information is so critical to our survival, surely distorting information would be dangerous. Wouldn’t the goal of protecting our self-esteem have been better achieved by making the brain’s self-esteem mechanism stronger instead? The new school of thought explains self-deception as “primarily outward-facing, manipulative, and ultimately self-serving”. This is based on Thomas Schelling’s work on game theory: “In a variety of scenarios, limiting or sabotaging yourself is the winn
Read more

Handling of the Satyam Scam

The Satyam scam. How does that fit into Montek Singh Ahluwalia’s book on reforms in India, Backstage ? The reason is that, as both NASSCOM and the government of India felt: “(Satyam’s) collapse would create a great deal of disruption for clients worldwide and seriously damage India’s reputation as a reliable source of software services.”   Therefore, the government decided to work with the private sector to “organize a quick takeover by a reputable new buyer, who would quickly restart the company”. But that could not be done overnight. In the meantime, the new board would have to reach out to Satyam’s clients and “reassure them that the company would survive”.   For the new board to have credibility when it made that statement, it had to be staffed with people who understood the private sector, the IT sector in particular, and commanded respect and trust. Deepak Parikh from HDFC was made chairman, and other members of the board included a former NASSCOM chairman, CII member,
Read more