OTP Bots: How They Work and How to Block Them

Looking for FreeOTP, the open-source authenticator app? That is a different thing: this page is about the criminal call-and-phish bots that trick people into reading their one-time passcodes to an attacker. If you run a service that sends OTPs, this guide is written for your fraud and engineering team: how the bots work, which controls actually stop them, and where phone-number gating fits.

Try Phone Validation for free and check any number’s line type and country before you send the OTP. 100 free requests a month, no credit card required.

What is an OTP bot?

An OTP bot is an automated tool that phones or texts a victim, impersonates a trusted service, and persuades them to reveal the one-time passcode that was just sent to their device. The bot relays the code to the attacker in real time, turning a stolen password into a completed login despite SMS two-factor authentication.

How an OTP bot attack works, stage by stage

The attack is a pipeline, and every stage is automated except the victim’s mistake:

1. Credential sourcing. The attacker starts with a username and password from a breach dump or phishing kit.
2. Login attempt. A bot enters the stolen credentials on the real site, which triggers a genuine OTP to the victim.
3. The call. Within seconds, the bot calls the victim with a spoofed caller ID, posing as the service’s fraud team.
4. The script. A convincing voice prompt asks the victim to enter or read the code they just received, framing it as identity confirmation.
5. The relay. The victim’s code reaches the attacker’s console in real time.
6. Session established. The attacker completes the login, changes recovery settings, and moves money or data before the victim hangs up.

Which controls stop OTP bots? An honest comparison

No single control closes this attack, and vendors rarely say so. The table answers two separate questions honestly: does the control stop the social-engineering relay above, and does it stop the adjacent SMS pumping fraud, the send-path half of the problem.

Where phone-number gating fits, stated plainly

Gating cannot stop a victim who reads a code aloud to a convincing caller. That failure is human, and the durable fix is passkeys or push approval with number matching. What gating does stop is the supply line: the disposable and VoIP numbers that let attackers farm accounts at scale, receive codes without a real phone, and resell verified accounts. Cutting that supply raises the attacker’s cost per account from cents to the price of a real SIM.

The check is one request at signup time and again at OTP-request time. Abstract’s Phone Validation resolves line type, carrier, and country before you send anything:

{
  "phone": "+14152007986",
  "valid": true,
  "format": { "international": "+14152007986", "local": "(415) 200-7986" },
  "country": { "code": "US", "name": "United States", "prefix": "+1" },
  "location": "California",
  "type": "voip",
  "carrier": "Twilio"
}

Gate on two fields: refuse or challenge when type resolves to voip, and apply your country allowlist. The same gate in Node.js and Python:

// Pre-send gate: refuse to send an OTP to risky numbers
const API_KEY = process.env.ABSTRACT_PHONE_KEY;
const ALLOWED_COUNTRIES = ["US", "CA", "GB"];

async function canSendOtp(phone) {
  const url = "https://phonevalidation.abstractapi.com/v1/?api_key="
    + API_KEY + "&phone=" + encodeURIComponent(phone);
  const res = await fetch(url);
  const data = await res.json();

  if (!data.valid) {
    return { allow: false, reason: "invalid_number" };
  }
  if (data.type === "voip") {
    return { allow: false, reason: "voip_line_type" };
  }
  if (!ALLOWED_COUNTRIES.includes(data.country.code)) {
    return { allow: false, reason: "country_not_allowed" };
  }
  return { allow: true, reason: "ok" };
}

# Pre-send gate: refuse to send an OTP to risky numbers
import os
import requests

API_KEY = os.environ["ABSTRACT_PHONE_KEY"]
ALLOWED_COUNTRIES = {"US", "CA", "GB"}

def can_send_otp(phone):
    res = requests.get(
        "https://phonevalidation.abstractapi.com/v1/",
        params={"api_key": API_KEY, "phone": phone},
        timeout=5,
    )
    data = res.json()
    if not data.get("valid"):
        return {"allow": False, "reason": "invalid_number"}
    if data.get("type") == "voip":
        return {"allow": False, "reason": "voip_line_type"}
    if data.get("country", {}).get("code") not in ALLOWED_COUNTRIES:
        return {"allow": False, "reason": "country_not_allowed"}
    return {"allow": True, "reason": "ok"}

To see the signal by hand, check a number’s line type free, no key required, or read how VoIP number verification works for what the line-type flag means underneath.