How a one-time passcode actually protects your money

It's easy to treat a one-time passcode as friction — one more box to fill in before you can get to what you actually wanted to do. But the specific fraud pattern it closes is worth understanding, because it explains why we don't make it optional.

The problem: a password is a static secret

A password, once it leaks — through a phishing page, a reused credential from another breach, malware on a shared computer — stays valid until you change it. Anyone who has it can sign in as you, indefinitely, until you notice.

The fix: a secret that expires before it's useful

A one-time passcode is generated fresh for a single action — signing in, or sending a transfer — and sent to your email rather than whatever device is currently attempting the action. Two things fall out of that:

• Someone with only your password can't complete the action, because they don't control your email.
• Even if a code is somehow intercepted, it expires quickly and can only be used once — so it's worthless outside a narrow window.

Why transfers get their own code

Signing in and sending money are different levels of risk, so we treat them as different actions requiring different codes. A session that's somehow already open — say, on a shared or unlocked device — still can't move money without a fresh transfer-specific code landing in your inbox first.

What you should still do

OTP closes one specific gap; it doesn't replace good habits. Use a unique password for your bank account, keep your registered email address secure, and if you ever get a code you didn't request, that's a signal — not a false alarm — to freeze your account and check what triggered it.