OTP bots: How they beat SMS 2FA and how to stop them

What are OTP bots?

An OTP bot is an automated service that gets one-time passwords out of their owners. It does not guess or crack anything. It calls or texts the victim, impersonates the organisation that sent the code, and asks for it.

The whole exchange is automated and timed to beat the code's lifetime, usually 30 to 60 seconds: contact the victim, deliver the script, capture the code, pass it to the attacker.

The goal is account takeover (ATO). With the password and the matching OTP, the attacker has full access to an account its owner believed was protected.

The anatomy of an OTP bot attack

Five steps. The first happens weeks earlier; the last four fit inside one code's expiry window.

Step 1: Credential acquisition

The attack starts long before the victim hears anything. Attackers buy usernames and passwords on dark web marketplaces, pull them from earlier breaches or phish them. With billions of credentials in circulation, a valid pair for most services is cheap.

Step 2: The login trigger

The attacker, or their script, logs in with the stolen credentials. The real service sends a real OTP to the victim's registered phone. Nothing about that message is fake, which is what makes the next step work.

Step 3: The social engineering call

Seconds later the bot calls or texts the victim. Caller ID is spoofed to show the bank, the technology company or the government agency the code came from.

The script: “We have detected suspicious activity on your account. To verify your identity and prevent unauthorised access, please provide the security code we just sent to your phone.” The victim has a genuine code in hand and a plausible reason to share it.

Step 4: Code relay

The victim reads the code out or types it into a fake page. The bot captures it and passes it to the attacker at once. Most OTPs expire within 60 seconds, so this step is automated for speed.

Step 5: Access granted

The attacker enters the code on the real login page before it expires. The service sees valid credentials and a valid OTP and lets them in. From there: change the password, move funds, take data, pivot to other accounts.

Why OTP bot threats are escalating

Three things changed.

Bots as a service

OTP bots are rented, not built. Telegram channels and dark web forums sell access for as little as $10 to $100 a week, scripts for specific banks and services included.

Anyone who can type a phone number can now run an MFA bypass. Volume followed.

Generative AI

Current bots use generative AI in three ways:

• Conversation. The bot holds a natural phone conversation, handles questions and adjusts to how the victim reacts.
• Voice cloning. Deepfake audio imitates a customer service agent, or someone the victim knows.
• Script tuning. Successful calls are analysed and the scripts refined per region and demographic.

“Gen4” bots

The newest generation is built to pass bot detection:

• Behavioural mimicry. Human-like mouse movement, scrolling and typing rhythm, aimed at systems that score behaviour.
• Adaptive timing. Realistic delays and variation to stay under rate limits and anomaly thresholds.
• Multi-channel coordination. Call, SMS and email in parallel, using whichever the victim answers.

The scale of the problem

This is measured, not theoretical.

• MFA bypass in half of incidents. Cisco Talos's 2024 data put attempts to bypass multi-factor authentication (MFA) in nearly 50% of its incident response engagements. For how MFA works and where it fails, see our guide to multi-factor authentication.
• $10 million from one bot. The JokerOTP operation, dismantled in early 2025, was behind over 28,000 successful attacks across 13 countries and an estimated theft of over $10 million.
• SMS pumping. The same bots drive SMS pumping fraud, which cost businesses billions between 2022 and 2024. Some platforms reported SMS costs up 300% from artificial traffic.

The threat model: Why they succeed

OTP bots exploit a design choice, not a bug. Most MFA implementations use a shared secret model:

1. Shared secret. The server generates a code and sends it to you. Both sides now know it.
2. Human relay. A person reads the code and types it in. That is the bridge.
3. Real-time phishing. If a bot can get the person to relay the code inside the valid window, usually 60 seconds, the server cannot tell the owner from the attacker.

Nothing cryptographic is broken. The bot exploits the trust assumption that whoever has the code has the phone.

Types of OTP bot attack methods

Four methods, from most to least common.

Voice-based social engineering

The most common. An automated call, pre-recorded or AI-generated, impersonates the organisation and invents a reason for urgency: a security threat, a payment to verify, a service about to be cancelled. The victim reads out the code to make the problem go away.

MFA fatigue

Against push-based authentication the bot does not ask for a code. It fires dozens or hundreds of approval prompts at the victim's device until the victim taps approve to make them stop. This has worked against large technology companies.

SMS interception through network flaws

The SS7 (Signalling System No. 7) protocol that routes calls and messages between mobile networks has known weaknesses that let an attacker intercept SMS remotely. The victim never sees the code and never knows it was taken.

SIM swap support

Some bot services include scripts for talking a mobile carrier's support staff into moving the victim's number to the attacker's SIM. After the swap every SMS, OTPs included, goes to the attacker.

The real-world impact

The damage reaches past the compromised accounts.

Direct fraud losses

JokerOTP alone took about $10 million from banking customers, cryptocurrency exchange users and ecommerce accounts across several countries before researchers exposed it in early 2025.

SMS pumping fraud

OTP systems can be turned against the company running them. Bots trigger huge volumes of OTP requests, and the company pays for every message. Social media platforms and authentication providers have been hit hardest, with some reporting SMS costs above $60 million a year from fraudulent requests.

Operational strain

Bot traffic costs more than the SMS bill:

• Server load. Floods of authentication requests eat capacity and slow the service for real users.
• Support volume. Victims who work out what happened all call at once.
• Trust. Customers who lose an account with 2FA switched on do not blame the bot; they blame the platform.

Case study: The JokerOTP operation

JokerOTP shows what an industrialised OTP bot looks like.

• The setup. A Bot-as-a-Service on Telegram. For roughly $100 a week, a criminal with no coding skill could rent it.
• The method. Pre-written scripts for dozens of services, including Amazon, PayPal, Coinbase and major banks. The attacker entered the victim's phone number and the service name.
• The failure. The targeted banks treated a correct OTP as the final word. They did not weigh the login's location, often overseas, against the customer's usual behaviour, and they did not flag how fast the code was entered.
• The impact. Thousands of accounts compromised before the ring was disrupted (2025). Victims handed over life savings believing they were helping their bank stop fraud.

For SOC teams: Detection signals

Prevention first, but detection is mandatory. Five indicators of OTP bot activity worth alerting on:

• High OTP-to-login failure ratio. OTPs generated without a successful login: the victim is ignoring the bot, or the code is expiring first.
• Burst then success. A tight cluster of failed logins, then a success, then a password or email change.
• Telemetry mismatch. A valid OTP entered under impossible travel: a login from Nigeria an hour after the same user logged in from London.
• SMS cost spike. An unexplained jump in the SMS provider bill is often the first sign of SMS pumping.
• MFA fatigue. Several push prompts rejected in a short window, then one accepted.

How to defend against OTP bots

No single control covers it. Four layers:

Move off SMS

SMS is the weakest form of MFA. Move accounts that matter to one of these:

• Authenticator apps. Time-based One-Time Password (TOTP) apps such as Google Authenticator, Microsoft Authenticator or Authy generate the code on the device. It is never sent over a network, so SS7 interception and SIM swaps do not apply. A voice bot can still ask the user to read it out.
• Hardware security keys. YubiKey, Titan Security Key and similar answer a cryptographic challenge bound to the site. There is no code to read out, so the bot has nothing to ask for.
• Passkeys. Public-key cryptography plus the device's biometric or PIN. A passkey only works on the site it was created for, so a fake page gets nothing and there is nothing to relay.

Score the login, not just the code

Look at the session before the code is checked:

• Device fingerprinting.** An unfamiliar device on a known account is a flag before any code is sent.
• Impossible travel. Two logins from distant places in too short a time: block or step up the second.
• Behavioural biometrics. Typing, mouse and navigation patterns separate the owner from a bot imitating one.

Technical countermeasures

Four changes to the OTP flow itself:

• CAPTCHA before the OTP. A human check before a code is sent stops scripts from triggering unlimited messages.
• Rate limiting. Cap OTP requests per account and per IP within a window. This cuts SMS pumping as well as rapid-fire attempts.
• Shorter validity. 30 seconds instead of 60 gives the relay less room.
• Out-of-band confirmation. For high-risk actions, require a second channel, such as an email confirmation for a phone-based login.

Education

Technology does not close the gap alone. Three things every user should know:

• No legitimate organisation calls to ask for an OTP. Codes go into the site or app you opened yourself, never into a call or message you did not start.
• Urgency is the tell. The script depends on panic. A real security team can wait while you check.
• Verify on your own terms. Hang up and call the number on the bank's website or card.

What comes after SMS

OTP bots are the industrialisation of a skilled attack. What took custom tooling now costs a weekly subscription on Telegram.

For individuals: SMS 2FA beats a password alone, and that is all it does. Put app-based codes, a hardware key or a passkey on every account that holds money or identity.

For organisations the trade-off is convenience and reach. SMS works on every phone. But an interceptable secret gives users a sense of safety the system cannot back, and the attacks against it run at scale.

Passkeys, hardware tokens and biometrics share the property that matters: there is nothing to say aloud, type into a fake page or intercept in transit. That is where authentication is going.

Where to start

This week: put rate limits and a CAPTCHA on the OTP endpoint, and alert on the five SOC signals above. This quarter: offer passkeys and start moving high-value accounts off SMS.

Sensfrx covers the step the JokerOTP banks missed. It scores the login that triggers the OTP from device, network and behaviour signals, so your rules can block or step up a session from an unknown device in another country before the code is even sent. Start with account takeover protection, or contact us if you have a question the docs do not answer.

Frequently asked questions (FAQs)