An OTP bot is an automated service that tricks a user into revealing a one-time passcode, then relays it to the attacker in real time, defeating SMS-based two-factor authentication. The JokerOTP operation, dismantled in early 2025, carried out more than 28,000 successful attacks across 13 countries. The attack works because a one-time code is a secret the user can be talked out of, and the code typically expires in 30 to 60 seconds, which is plenty of time for a bot to relay it. NIST SP 800-63B, published in 2017, recommends against SMS as a sole second factor, and Cisco Talos reported in 2024 that about 50 percent of its incident response engagements involved MFA bypass attempts.
The relay, step by step, and why the code is the weak point
The attack starts with a message, usually a fake delivery notice, a bank alert, or a login warning, and a phone call or a chat that follows it. The bot, often running on Telegram, calls the victim and reads a script: there is a suspicious login, a package held, an account locked, and the fix is to read back the code that just arrived by text. The victim reads the code, the bot relays it to the attacker, and the attacker enters it into the real login page before the 30 to 60 second expiry. The account is open, and the victim only learns about it when the password stops working.
The code is the weak point because it is a secret that travels through the user. A hardware key or an authenticator app keeps the secret on the device, and the user cannot be talked into handing it over, because there is nothing to read out. An SMS code is different: it arrives as text, it can be read aloud, and it can be relayed by anyone who hears it. The SS7 protocol that carries SMS was designed in 1975 and has no sender authentication, which means a text message can be spoofed, intercepted, or rerouted by an attacker who knows the network. The code is a password with a 60-second life, and it is stolen the same way passwords are stolen: by asking.
Related reading on this site: Home and Bot Farms vs Device Farms: Two Different Infrastructures, Two Different Tells cover the neighbouring problems in more depth.
The scale, and why it keeps growing
JokerOTP is the clearest measure of the scale. The operation was dismantled in early 2025 after more than 28,000 successful attacks across 13 countries, and it was not a lone hacker. It was a service, sold to other criminals, with a bot that handled the calls, the scripts, and the relay. The customer paid for a successful code, and the bot delivered it. SIM-swap losses, the related attack where the attacker takes over the victim's phone number entirely, passed $72 million reported to the FBI's Internet Crime Complaint Center in 2022, and the number has grown since.
The growth is driven by the economics. A bot that can defeat SMS two-factor authentication turns every account protected only by SMS into an open door, and most accounts are protected only by SMS. Cisco Talos reported in 2024 that about 50 percent of its incident response engagements involved MFA bypass attempts, which means half the breaches the firm investigated started with a second factor that failed. The attackers are not breaking cryptography. They are calling the victim and asking for the code, and the victim is giving it to them, because the call sounds like the bank.
What replaces SMS, and what to do until then
The fix is to stop using SMS as the second factor, and NIST said so in 2017. Authenticator apps, hardware security keys, and passkeys keep the secret on the device, where it cannot be read out over the phone, and they are the replacement for every account that matters. A service that offers only SMS two-factor authentication is offering a second factor that a bot can defeat with a phone call, and the honest description of that service is that it stops automated credential stuffing and does not stop a targeted attack. That is still worth having, but it is not the protection the user thinks they bought.
Until the migration is done, the defenses are procedural. Never read a code to anyone who calls, even if the caller ID says the bank, because a bank will never ask for a code over the phone. Treat any message that arrives with a code you did not request as an attack in progress, and change the password on that account immediately. And watch for the SIM-swap signal: a phone that suddenly loses service, with no bars and no data, while the account password stops working, means the number has been moved to an attacker's SIM, and the carrier needs to be called before the bank. The code is the last line of defense, and it is the line the attacker knows how to cross.
Frequently asked questions
What is an OTP bot?
It is an automated service that tricks a user into revealing a one-time passcode, then relays it to the attacker in real time. The JokerOTP operation, dismantled in early 2025, carried out more than 28,000 successful attacks across 13 countries.
How long does a one-time code stay valid?
Typically 30 to 60 seconds, which is plenty of time for a bot to relay it. The short expiry does not stop the attack, because the relay happens in real time while the code is still live.
Why is SMS a weak second factor?
Because the code is a secret the user can be talked out of, and the SS7 protocol that carries SMS, designed in 1975, has no sender authentication. NIST SP 800-63B, published in 2017, recommends against SMS as a sole second factor.
What should I use instead of SMS two-factor authentication?
An authenticator app, a hardware security key, or a passkey, which keep the secret on the device where it cannot be read out over the phone. Until then, never read a code to anyone who calls, and treat an unexpected code as an attack in progress.