A one-time passcode (OTP) is a short-lived authentication code used to prove identity during login or to confirm a transaction. It is usually valid for only a brief window and may be delivered by SMS, an authenticator app, or a banking app prompt. Because the code expires quickly, it is meant to reduce the value of stolen passwords and limit replay attacks.
In cyber security, OTPs matter because attackers often try to steal them in real time. Mobile banking trojans, phishing pages, overlays, and malicious accessibility abuse can capture the code before it expires or trick users into entering it into a fake screen. Defenders should treat OTPs as useful but not foolproof: they work best when paired with phishing-resistant MFA, device binding, transaction signing, and behavioral detection that can spot unusual prompts or suspicious app behavior.