Computer skills from scratch·Stay safe·Lesson 98 of 180
OTPs — codes that die
Ellis Dennis GrahamFounder, Cyber Elias Academy 2026-09-14 3 min
A six-digit SMS is a key that works once. Nobody who is helping you needs to hear it. Type it into the page you opened on purpose. Then let it expire.
A bank, a mail, a government portal will send a short number to the phone: one-time password, OTP, token. It is a second lock. It dies in minutes. It is not a PIN you reuse. It is not a balance. The whole crime of the last few years, in this city, is someone asking you to read that number aloud. This lesson is where it belongs — the page you walked to — and where it does not: a call, a WhatsApp, a “Microsoft support.”
You typed your password on the real street. The site says it will SMS you. Wait. The phone lights. A sender that looks like the bank, or 33123, or Google. Open the SMS, not a WhatsApp that arrived at the same time. Type the digits into the same page. Submit once. If the page says wrong, wait for a new code; the old one may already be dead. Do not type the code into a second page that popped up. One walk, one box.
Calls, WhatsApp, and the helpful thief
A voice: we are the bank, we are reversing a debit, read the code we just sent. Hang up. Call the number on the back of the card. A WhatsApp: send the code to confirm your BVN. You already know that play. A page that arrived from a link and then asks for OTP is two rooms: their fake, then your real SMS, which they will use on the real bank. Close. Walk to the bank yourself. If nothing is wrong, nothing is wrong.
Autofill on a phone may offer to paste the code. That is convenient on your phone, on the real app. It is a trap if a fake app is in the foreground. Look at the app name before you Accept. Some banks' own apps ask for a token from a hardware fob or from their app, not SMS. Obey that. Do not hunt a code in SMS that was never sent.
- The next time a real site sends a code, type it yourself. Do not read it to anyone.
- If a call asks for it, hang up. Dial the printed number.
- Delete old OTP messages when you remember. They are dead, but they clutter.
- Do not screenshot an OTP into a group to “show I tried.”
When it does not arrive
Airplane mode, no signal, a full SIM, a new number the bank does not have. Switch the plane off. Wait a minute. Resend once. If you just ported a number, tell the bank before you panic. Do not give a shop your OTP to “unlock a faster SIM.” That is the key to the house.
The second lock only works if the second key stays in your hand. Password, then OTP, then you are in. Anyone who wants the middle of that sandwich wants the house. You have had this lesson in other clothes. The digits are just smaller. Let them die in the box you chose, not in a stranger's ear.
