Chapter 13: One-Time Password: The Key to Your Account

If I were to ask you on the street for the key to your house, you would likely call the police or at least walk away from me with quick steps. If I were to ask you for the secret PIN of your credit card next to an ATM, you would look at me like I was a lunatic. We are raised from birth to guard physical property, keys, and wallets. But in the digital world, the concept of a "key" has changed. It is no longer made of metal, and it is not in your pocket. It consists of six digits sent to you in an SMS message, and it is called an OTP — One-Time Password.

In this chapter, we will address the most critical failure point in the modern security chain. The one-time password is the last line of defense. It is the gate that separates the fraudster from your money, and between a hostile account takeover and the protection of your account. Yet, paradoxically, precisely because it is the final "guard," it has become the primary target for digital criminal organizations. Throughout my years of professional work, the same sentence comes up again and again: "But I gave him the code. I am guilty, right? I have no chance of getting my money back."

The answer to this question is much more complex than it appears on the surface. It lies in the depths of the psychology of fraud and the language of Israeli law, which attempts to balance the customer's responsibility with the financial institution's duty of care. Let's dive in.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

The Story of Erez: When Self-Confidence Meets the Skilled Scammer

Erez (a pseudonym) is not the person you would have expected to fall into a trap. 42 years old, a software engineer by profession, a man who lives and breathes technology. He is aware of phishing, he knows what "end-to-end encryption" is, and he was always the one warning his elderly parents not to click on suspicious links. One Tuesday, at 6:30 PM, while Erez was trying to juggle between making dinner for the kids and answering urgent emails, his phone rang.

On the display appeared the name: "Bank Leumi - Security Center." The number was identical to the one appearing on the back of his credit card (a technique we expanded upon in the previous chapter regarding caller ID spoofing). Erez answered.

"Hello, this is Daniel from the bank's security department," said an authoritative, calm voice, with background noises of an active call center—other phone rings, murmurs of representatives—heard behind him. "Erez, we are currently detecting an unusual withdrawal attempt from your account at the Be'er Sheva branch. Did you authorize a transfer of 8,500 NIS to someone named 'Mohamed Ahmed'?"

Erez's pulse quickened. "What? Absolutely not! I'm at home in Haifa, I didn't authorize anything like that."

"I understand," replied Daniel in a reassuring tone. "Don't worry, our system has temporarily blocked the action, but to cancel it permanently and protect the account from further attempts, I need to perform verification against your app. I am sending you a message from the bank now with a temporary code. Read it out to me so I can enter it into the system and lock out the unauthorized access."

Within seconds, Erez's phone vibrated. An SMS message entered the bank's regular message thread. The text read: "Your code to access the account is 449281. Do not share this code with anyone." Erez saw the warning, but Daniel was on the line. Daniel was "from the bank." Daniel was there to save him from the thief in Be'er Sheva.

"I received it," Erez said. "The code is 44-92-81."

"Excellent, Erez. I see the action has been canceled. Now, to be 100% sure, the system requires an additional confirmation to resync your device. I am sending another code."

The second code arrived. This time, Erez didn't even read the warning. He simply read out the numbers. "992103."

"Thank you very much, Erez. Your account is now protected. A representative from the branch will call you tomorrow morning to issue a new card. Have a good evening." The call was disconnected.

Erez went back to making omelets. He felt relieved. Lucky the bank is vigilant, he thought to himself. Only an hour later, when he logged into the app to check if his balance had updated, he discovered the bitter truth. The account was not protected. On the contrary. It was emptied. Two "Gold" transfers (RTGS) of 50,000 NIS each were executed from his account within minutes of the call. In addition, a new standing order was added and purchases were made abroad.

What Erez did not know was that while he was talking to "Daniel," the fraudster was sitting in front of the computer. The first code Erez gave was the code that authorized the fraudster to enter his account from a new device. The second code was the authorization for the massive funds transfer. "Daniel" was not from the bank; he was the thief himself.

The Anatomy of the Fraud: What Really Happens Behind the Scenes?

To understand why the one-time password is such a powerful tool for fraudsters, we must understand the modern banking system. Banks have shifted to a method of "Two-Factor Authentication" (2FA). The idea is simple: to perform a sensitive action, it is not enough to know something (a password), you must also possess something (your mobile phone).

The fraudsters realized that they do not need to hack the bank's servers—a near-impossible task. They need to hack the weakest "server" in the system: the human brain. This is social engineering at its best. The one-time password is the final barrier, and they obtain it by creating a sense of urgency and anxiety.

When Erez read the code, he essentially performed a legal and technical act of "approval." From the perspective of the bank's computerized systems, the action was performed by the customer himself, because the code was sent to his verified device and typed in correctly. This is the reason why banks are quick to shirk responsibility in such cases. They claim it constitutes customer negligence.

But is it that simple? Does the fact that Erez provided the code seal his fate regarding the chance of getting his money back? Here, the complexity of legal analysis enters.

The Legal Battlefield: Payment Services Law and the Thin Line of "Gross Negligence"

In Israel, the primary legal framework regulating the relationship between the customer and the bank in cases of fraud is the Payment Services Law, 2019. This law replaced the old Credit Card Law and expanded consumer protections in the digital age.

Section 14 of the law deals with an "unauthorized payment transaction." The basic rule is that if an action was performed in an account without the customer's authorization, the bank (or credit card company) may be required to refund his money. However, there is a significant exception: if the customer acted with "gross negligence," the bank may be exempt from restitution, or at least from part of it.

Here the legal examination begins. Representatives of financial institutions may argue that providing an OTP code is "gross negligence" by definition, due to the warning appearing in the message.

However, a legal analysis of prevailing trends shows that "gross negligence" is a relative concept. It is customary to examine the totality of circumstances:

• The Sophistication of the Fraud: Did the fraudster use prior personal information about the customer to gain his trust?
• Caller ID Spoofing: When the call appears to be from an official source, the customer may find himself in a state of optical deception that makes it difficult to identify the scam.
• The Customer's State: Did the circumstances during the call affect the customer's judgment?
• The Bank's Monitoring Duty: This is a key point. The banking institution is required to operate systems for monitoring unusual activity. A legal examination will check whether the alert systems functioned properly and whether the action could have been stopped in time.

In many cases, it is possible to examine the argument that even if the customer was negligent, there is also certain responsibility on the part of the financial institution if it did not identify extremely unusual activity. Legal liability may be divided between the parties according to the circumstances of the case.

Beyond the Code: How to Build a Psychological and Legal Defensive Wall

The one-time password is just the symptom. The problem is the ability of fraudsters to build an "alternative reality" where providing the code seems like the only logical action. As a rule of thumb, it is important to remember that a banking institution is not supposed to proactively ask for a code sent via SMS for the purpose of canceling an action or securing an account during a phone call.

An OTP code is intended for executing actions. Providing the code to a third party may allow them to perform actions on your behalf.

What do you do when the pressure in the call is immense? The recommended professional answer is to disconnect. You can end the call and proactively contact the official number of the financial institution to check the status of the account.

Legally, documentation is critical. In case of suspected fraud, it is recommended to document the time of the call, the phone number, the wording of the SMS message, and any other detail. These details may serve as tools in a legal examination of the case and an attempt to recover the funds.

The Gatekeeper That Became a Trojan Horse

The technology designed to protect us may sometimes be used as a weapon in the hands of fraudsters who perform a "soft hack" through the user. There are more complex techniques for taking over communication devices, which we will expand on later.

It is important to remember: legal struggle in such cases requires deep understanding. Financial institutions are backed by extensive legal advice and will tend to argue for customer responsibility. Professional examination will attempt to show the complexity of the representation presented to the victim and the level of sophistication of the hostile entity.

Modern legal analysis recognizes that instances of telephone fraud are common, and one must examine whether it is reasonable to expect a citizen to identify every sophisticated fraud attempt at any given moment. Sometimes institutional responsibility is examined alongside personal responsibility.

Red Flags

• Excessive Urgency: Creating pressure for immediate action by claiming the money is in danger.
• Requesting a Code to Cancel an Action: A request to receive an OTP code for the purpose of canceling a transaction or securing an account.
• Proactive Call at Unconventional Hours: Attempts to verify actions by phone during times when regular centers are not fully operational.
• The Representative's Inability to Provide Identifying Details: Difficulty for the caller to provide information that only the bank should know.
• Language and Syntax: Spelling errors or unusual phrasing in SMS messages from the financial institution.

Action Plan

1. Disconnect and Verify: End the call and proactively contact the bank's official center.
2. Documentation: Screenshot of messages, recording phone numbers and names as presented.
3. Blocking: If a code was provided, it is recommended to act to change passwords or freeze cards immediately.
4. Reporting to the Bank: Report to the financial institution's security center and document the inquiry number.
5. Filing a Police Complaint: A required step for the purpose of clarifying the facts and a potential claim for restitution.
6. Legal Advice: One can explore options for fund recovery through consultation with a professional in the field, to check whether the required duty of care was met by the bank.

Legal Aspect: Summary of Responsibility

When coming to examine a one-time password fraud case, the legal analysis will focus on examining the responsibility of each party. According to the Payment Services Law, the burden of proving gross negligence rests on the financial institution. This is a significant legal burden.

Throughout years of professional work, it is customary to analyze each case on its merits: Were the warnings clear? Did the technological systems identify the activity as unusual? Are there indicators of failures in the financial institution's defense array?

Remember: providing a code is indeed a mistake, but under certain circumstances, it is possible to examine whether it amounts to "gross negligence" that denies your rights. The financial system is based on trust, and under possible circumstances, after examining the evidence, the parties may reach understandings or settlements regarding the return of funds. The chance depends on the specific circumstances of each case.

In the next chapter, we will deal with one of the most complex tools in the digital fraudster's arsenal: remote takeover of endpoint devices.