OTP Text Message: What It Means and Whether It Is Safe

An OTP text is a message with a one-time code for signing in or confirming an action. It is safe if you asked for it; if you did not, do not share it.

What an OTP text looks like

It usually names the app, gives a 4 to 8 digit code and says how long it lasts, for example "123456 is your sign-in code. It expires in 10 minutes." Many end with a warning never to share the code.

Is it safe?

• You just asked for it: enter it in the app and you are done.
• You did not ask for it: someone typed your number by mistake or is trying to get into your account. Do nothing with the code.
• Someone then asks you for it: it is a scam, whoever they claim to be.

Signs of a fake OTP text

• A link asking you to "confirm" or "unlock" your account.
• Spelling mistakes or an odd sender name.
• Pressure: "your account will be closed in 1 hour".

Genuine OTP texts rarely ask you to tap a link. When in doubt, open the app yourself instead of using the message.

Why OTP texts come from strange numbers

Companies send codes through messaging providers, so the sender may be a 5 or 6 digit short code or a regular number that changes. That alone is not a warning sign. See SMS short codes explained.

Why OTP texts start with odd symbols

Some codes begin with characters such as <#> or end with a string of letters and numbers. These help Android read the code automatically and fill it into the app, so you do not have to copy it. Others, such as Google's, add a prefix like G- so you can tell which service sent the code. None of these symbols means the message is fake on its own; what matters is whether you just asked for a code.

FAQ

Why did I get an OTP I did not request?

Someone may have entered your number by mistake, or tried to sign in to your account. Do not share the code, and change your password if it keeps happening.

Can someone hack me with an OTP text?

Only if you give them the code or tap a fake link. Receiving the text alone does not give anyone access.

Should I reply to an OTP text?

No. Codes are entered in the app, not sent back by text.

Related: codes you did not request · fake verification texts · what an OTP is.