What does a successful one-time passcode prove?¶
It shows that the correct temporary code was entered within the required process and window. It does not prove account-holder identity, understanding or consent.
Delivery and entry can involve different people¶
Codes may arrive by SMS, email, application or authentication service. Another device user, an interceptor, remote operator or deceived victim can receive or enter them. Registered contact details do not prove present device possession.
Reconstruct the challenge¶
Preserve issue, destination, delivery, validation and linked payment times; endpoint, session and IP-related data; repeated requests; SIM or recovery changes; communications and remote-access evidence.
State that the challenge succeeded and then address who controlled the receiving channel, entered the value and why. Avoid unnecessarily reproducing live codes.
The point to remember
Use passcode records to establish challenge completion, then prove who controlled the delivery route and entered the code under what circumstances.
