A one-time password (OTP) is a single-use code that expires after a set time. Unlike fixed passwords, OTPs generate different codes each time, preventing reuse if intercepted. They serve as the "possession factor" in two-factor authentication.
Three main delivery methods exist. First, SMS sends 4-6 digit codes, the most common method for banks and online services. Second, authenticator apps (Google Authenticator, Microsoft Authenticator) generate new TOTP (Time-based OTP) codes every 30 seconds. Third, dedicated hardware tokens display codes on keychain-sized devices.
SMS OTP has vulnerabilities. SIM swap attacks that hijack phone numbers redirect OTPs to attackers. "Real-time phishing" via smishing relays user-entered OTPs to attackers instantly. Authenticator apps are more secure than SMS OTP.
Watch for OTP-exploiting scams: "This is bank security. Please read back the number we just sent." Legitimate banks never ask for OTPs by phone. See two-factor auth phone risks for detailed analysis.