Skip to main content
Qubicweb logo
ReviewedAccount takeover

Fake support call requesting OTP

A caller claims to be from a bank, wallet, delivery app, or marketplace and asks for an OTP to stop a pending fraud event.

Phone callWhatsAppBankingIndividualsGuild memberBusinesses

Structured social caption

Fake support call requesting OTP: A caller claims to be from a bank, wallet, delivery app, or marketplace and asks for an OTP to stop a pending fraud event. No genuine support team needs your OTP. End suspicious calls and contact the platfo

Landscape PNGSquare postStory PNG
Fraud cardTrustOps reviewed

Account takeover

Fake support call requesting OTP

A caller claims to be from a bank, wallet, delivery app, or marketplace and asks for an OTP to stop a pending fraud event.

Red flags

1The caller asks for an OTP, PIN, password, or reset code.
2You are told your account will be locked unless you act immediately.
3The caller refuses to let you end the call and contact official support yourself.

What to do now

End the call. Contact the organisation through the official app, website, or printed card number. Change passwords and enable stronger account protection where available.

Account takeoverOTP social engineering
Share reviewed guidanceOpen image

What happened

The scammer starts an account reset, login, or transaction, then calls the victim to collect the OTP needed to complete it.

How it works

The attacker creates fear, borrows the language of customer support, and tries to keep the victim on the call until the code arrives.

Red flags

  • The caller asks for an OTP, PIN, password, or reset code.
  • You are told your account will be locked unless you act immediately.
  • The caller refuses to let you end the call and contact official support yourself.

What to do now

End the call. Contact the organisation through the official app, website, or printed card number. Change passwords and enable stronger account protection where available.

What not to do

Do not read out OTPs, PINs, recovery codes, card numbers, or passwords. Genuine support teams do not need them.

Evidence notes

  • Caller ID can be spoofed, so the displayed number is not proof of legitimacy.
  • Report the claimed organisation, call time, phone number, and wording, but never submit OTPs.