An OTP bot is an automated program that captures or abuses one-time passwords in order to pass a second login check.
It targets the short window in which a code is still valid.
Understanding One-Time Passwords
A one-time password works for a single action or for a few seconds.
After that it is useless, unless someone read it in time.
Types of OTPs
Codes arrive by SMS, email, authenticator app or hardware token.
Apps and hardware create the code on the device, while SMS and email send it over another channel that attackers can intercept.
Understanding Two-Factor Authentication
Two-factor authentication asks for a second, independent proof besides the password.
A stolen password alone is then not enough to sign in.
Methods of 2FA
Common methods are one-time codes, approval prompts in an app and security keys.
Strength depends on whether the second factor is separate from the password and whether the user recognises a fake prompt.
Understanding Bots in Cybersecurity
Bots submit logins, forms and requests at scale without a person.
An OTP bot specialises in stealing a one-time code or forwarding it immediately.
How OTP Bots Operate
The bot presents a convincing sign-in page, collects the password and the code, and uses both at once against the real service.
Some variants forward an SMS through malware on the phone or persuade the victim to read the code aloud.
Preventing and Detecting OTP Bots
Users should not enter codes on a page they reached from an unexpected message.
Services notice attacks by many codes in a short time, unfamiliar devices and sessions that stop immediately after the second factor.
Tools for Detecting OTP Bots
Warning signs include mass requests to the sign-in page, repeated failures and a changing source address between steps.
Rate limits, device binding and a CAPTCHA before a code is sent make automation harder.
CDPCaptcha has the browser solve a small computational task that people hardly notice and that becomes expensive for bots at scale, without cookies and without fingerprinting.
Conclusion
One-time codes protect an account only while they are not captured and used in the same moment.
Binding the second factor to the device and slowing automated code requests removes the room OTP bots need.