A one-time password, or OTP, is the short code that arrives by SMS or appears in an app when you try to log in or approve a payment. It exists to prove that you, and not someone else, are trying to do something. That is why no legitimate organisation needs you to read it out.
On 7 October 2026, the Bank of Ghana issued a twenty-point advisory on digital financial fraud. Its core message was simple: no legitimate bank, mobile-money operator or payment service provider will ask for your PIN, password or one-time password by phone call, text, email or social media. The Cyber Security Authority has also been urging the public, during this year’s National Cyber Security Awareness Month, to pause before clicking links, verify details before transferring money, and protect passwords and one-time codes.
This article explains how the scam usually works, what to do if you have already shared a code, and how to set a simple rule for your business so the same mistake does not happen twice.
How the OTP scam usually works
The script changes, but the structure is nearly always the same:
- The call comes first. A caller says they are from your bank, your telco, a delivery company, a government office or a “customer care” line.
- There is an urgent reason. Your account is “blocked”, a transfer is “pending”, a parcel is “held”, or someone has “tried to log in”.
- They ask you to confirm. You are asked to read out the code they have just sent you, or to approve a prompt that you did not start.
- The code is the key. The caller is actually trying to log in or authorise a transaction on your account at the same moment. The code they receive is their proof.
Sometimes the scammer will also ask for your Ghana Card number, account number or PIN. Treat every one of those requests the same way.
The rule to remember
Never read out, type in or forward an OTP to anyone who contacted you first. If you started the login or transaction yourself, you can see the code on your screen and enter it into the official app or website. If someone else asks for it, the answer is no, even if the caller knows your name.
Check this rule against two questions:
- Did I start this request? If not, do not approve it.
- Would the real provider ever ask me for this code? If the answer is no, hang up or close the message.
What to do if you already shared a code
Speed matters more than embarrassment. Work through these steps in order.
- Contact your provider using a number you already trust. Use the number on the back of your bank card, the official app, or the telco’s published customer line. Do not call back the number that contacted you.
- Ask them to block the transaction or lock the account. Say that you shared an OTP with someone who is not the provider.
- Change your PIN and passwords. Change them from the official app or website, not through a link you were sent. Use a different password for email, your bank and mobile money.
- Check your alerts and statements. Look for logins, transfers, new devices or changed contact details you do not recognise.
- Turn on transaction alerts if they are not already active, and check that your email and phone number on the account are correct.
- Report it. The Cyber Security Authority accepts reports by calling or texting 292 or by emailing report@csa.gov.gh. Keep a note of the time, the number that called and what was said.
- Do not promise yourself a recovery. Money that has already moved can sometimes be traced or reversed, but this depends on the provider and how quickly you act. Report it immediately either way.
Where small businesses get caught
A business is more exposed than an individual, because several people often touch the same phone or account. Watch for these situations:
- A shared phone at the shop receives OTPs for the owner’s personal or business accounts. Only the account holder should receive or read these codes.
- A staff member is asked to “confirm” a payment on behalf of a supplier or a customer. Confirm the request through a number you already have, not the one in the message.
- A “customer care” account on WhatsApp or social media asks for a code to “verify” a refund. This is a common impersonation pattern. Verify before you respond.
A simple written rule helps: OTPs are for the account holder only, and never for anyone who contacted us first. Put it where your team can see it.
When to get help
If you are unsure whether a request is genuine, stop and call the provider directly on a trusted number. If you have already shared a code and money has moved, act within minutes rather than hours. If you need a second pair of eyes on your phone, your accounts or a suspicious message, you can ask for basic guidance from our Business IT team. We will explain what we can and cannot check, and we will not ask you for any PIN, password or OTP.
This article is general information, not legal or financial advice. Follow your provider’s current instructions, which take priority over anything written here.