What does a successful one-time passcode prove?¶

A successful one-time passcode shows that the correct temporary code was entered within the required process and time window.

Avoid this assumption: This proves the account holder personally authorised the payment.

The code may have been sent by text message, email, banking application or another authentication service.

It may have been entered by the account holder, another person with access to the device, an offender who intercepted the code or someone remotely controlling the device.

A victim may also disclose the code after being deceived.

Relevant records may include the destination phone number or email address, delivery time, code issue time, validation result, IP address, device, session and linked payment reference.

Ask the provider whether the code was delivered successfully, whether several codes were requested and what transaction or login it related to.

Preserve messages or application notifications showing the code request, but avoid reproducing live security codes unnecessarily.

Compare the event with device evidence, SIM changes, account recovery, communications, remote-access software and the user’s explanation.

A successful code can strengthen evidence that the authentication requirement was completed, but it does not prove informed consent or personal identity.

Do not assume that possession of the registered phone number means possession of the device. SIM swapping, forwarding, account compromise or shared access may be relevant.

When reporting, state that the one-time passcode challenge was successfully completed rather than naming the person who completed it.

Operational takeaway¶

Use one-time-passcode records to prove completion of the authentication challenge, then investigate who received, controlled and entered the code and why.