One-Time Password

OTP Full Form in English, letter by letter

OTP is a One-Time Password, a short code valid for a single login or payment, sent to your phone or generated by an app.

OTP Full Form in Indian Languages

OTP is the code that arrives on your phone before a payment or login: the One-Time Password. Its name is shown below in six Indian languages.

How an OTP works

A One-Time Password is created for one login or one transaction, sent to your registered mobile number or email, and expires after a short time, often a few minutes, whether you use it or not. It is different from a PIN, which stays the same until you change it.

Because each code is new and valid only once, a code captured from one transaction cannot be replayed for another. That is why banks moved to OTPs: static passwords were easy to steal, reuse and share by accident. The OTP is a second proof, added to something you already know such as a password or card details.

SMS, app-based and hardware OTPs

The most common type arrives by SMS or a voice call. Another type comes from an authenticator app using the TOTP standard, which creates a new code every thirty seconds on the phone itself and does not need mobile network at that moment.

A third family is HOTP, a counter-based method described in RFC 4226, which older hardware tokens used. Banks also send approval prompts inside their apps. These are not OTPs as such, but they serve the same purpose of confirming that you are present.

For people who travel abroad, an app-based code is more reliable than SMS, since it does not depend on roaming. Banks and government portals increasingly offer both options on the same login page.

OTP in Indian banking and UPI

Online card payments in India need additional authentication under RBI rules, and for most transactions that is an OTP on the bank's own page before money moves. Card tokenisation, mandatory for merchants since October 2022, replaced the card number stored at a shop with a token, but the OTP step remained.

UPI works differently. An OTP or SMS verifies your phone number when you register, and later each payment is authorised by your UPI PIN. So if a caller asks for your UPI PIN to 'receive' money, it is a fraud: a PIN is only ever needed to send money.

Why OTP fraud still works

Most losses come from tricking the user, not from breaking the code. Fake messages pose as banks, callers claim to be from customer care, and SIM-swap fraud moves your number to a SIM in the scammer's hands. Codes forwarded to a 'helper' or typed into a fake checkout page cause many of the reported cases.

Banks and the RBI repeat one rule: nobody from the bank, the regulator or customer care will ask you for an OTP or PIN. Reading one out to a caller hands over the account, and the money is often hard to recover. If you have shared a code by mistake, call your bank immediately and report the fraud on the national cyber crime helpline, 1930.

A sensible habit is to read the whole OTP message. Genuine messages state the purpose, such as the amount and merchant for a payment, and a code for a payment you did not start should be ignored and reported.

Beyond banking: where else an OTP appears

OTPs also guard logins to email, DigiLocker and the income tax portal, and they appear in the last step of many KYC checks and in delivery confirmations. That is why codes seem to arrive from everywhere.

Delivery riders ask for an OTP to confirm that the parcel reached the right person. Share it only when you hold the parcel in your hands.

Why your OTP does not arrive

Common reasons are a network outage, roaming, a full inbox, a phone with message filters, or a bank record that still holds an old mobile number. A DND registration does not normally block bank OTPs, since these are sent as transactional messages. A recently ported number can also cause a delay.

If an SMS is late, wait for the validity window to end, then request a new code instead of tapping repeatedly. Many banks allow only three attempts, after which the code goes void, and too many requests can lock the option for the day. An app-based code or a voice call is the usual fallback.

Treat every One-Time Password like your signature: it is for you alone, it works once and it should never be read out. If a call or message asks for your OTP, end it and contact the bank on the number printed on your card.

OTP Full Form: Common Questions