Why One-Time Codes Expire and How to Stay Safe
You were halfway through a UPI payment or logging into an app when
the screen showed OTP expired. The code on your phone is now
useless. You have to start all over again.
This happens to millions of Indians every day. But that expiry is
not a glitch or a flaw. It is one of the most deliberate safety
features protecting your bank account.
What a One-Time Code Actually Does
A one-time password, or OTP, is a short temporary code sent to your
registered phone number or email. It confirms that the person making
a request is actually you. Unlike your regular password, an OTP can
only be used once and only within a fixed time window.
Most SMS OTPs in India stay valid for anywhere between 30 seconds
and 5 minutes. Banking and UPI apps tend to use shorter windows,
often under two minutes, because the financial risk is higher. Apps
like Google Authenticator go even shorter, refreshing a new code
every 30 seconds automatically.
Why One-Time Codes Are Designed to Expire
The logic becomes clear once you think about it this way. An OTP
that never expires would be as risky as leaving your house key
outside your front door. Anyone who found it could use it whenever
they wanted.
When you request an OTP, the server creates a unique code and
attaches a timestamp to it. When you enter the code, the system
checks two things in sequence is the code correct, and is the time
window still open? If either check fails, the code is rejected and
the session closes.
The shorter the window, the smaller the opportunity for a fraudster
to misuse a stolen code. Even a 5-minute window is considered
generous by security standards, because it gives someone trying to
intercept a code more time to work with.
This matters a great deal for India. Nearly 2.5 million people
in India lost about $2.5 billion to digital fraud in 2025, a
4,300% increase since 2021, which prompted the Reserve Bank of
India to propose new protective measures. A short OTP window does
not stop all fraud, but it removes one significant opening that
attackers would otherwise exploit.
What to Do When Your OTP Expires Before You Can Use It
The most common reason OTPs expire before use is distraction.
You receive the code, set your phone down for a moment, and by
the time you return to the screen, the session has already closed.
Do not try entering the expired code. Most systems reject it
immediately, and some apps will lock your screen for a minute or
two after too many failed attempts. Instead, look for a Resend
OTP button on the same screen. Most platforms make you wait 30
to 60 seconds before sending a new code. The new code replaces
the old one and comes with a fresh time window.
If codes are consistently arriving late, the issue is usually
your telecom network rather than the app. During peak hours in
busy cities like Mumbai, Delhi, or Hyderabad, SMS networks can
slow down under high traffic. Moving to a better signal area
sometimes helps. Some platforms also let you choose OTP delivery
via WhatsApp or email in their settings, and switching can speed
things up noticeably.
How to Handle One-Time Passwords Safely Every Day
A one-time code is only as safe as your behaviour around it.
The code itself is strong by design, but human decisions are
where most fraud actually happens in India.
Enter it the moment it arrives. An OTP sitting on your lock
screen for three minutes is an unnecessary risk. Use it straight
away, especially for banking, UPI, or any financial transaction.
Never share it with anyone. No bank, no payment platform,
no customer care agent, and no government official will ever ask
for your OTP over a phone call. The RBI has confirmed that OTPs
are meant to be private to the user and that sharing one
invalidates the protection entirely. If anyone calls asking for
your code, disconnect the call immediately.
Check the sender name before trusting the code. Genuine OTPs
from banks arrive from registered sender IDs, such as HDFCBK
or SBIBNK. A code arriving from a private mobile number like
98xxxxxxxx is a clear warning sign.
Consider using an authenticator app for important accounts.
Apps like Google Authenticator or Microsoft Authenticator generate
time-based codes directly on your device. Because these codes are
never sent over SMS, they cannot be intercepted through a network
or a SIM-swap attack.
From April 1, 2026, the RBI mandated two-factor authentication
for all digital payment transactions in India, requiring at least
two distinct verification methods per payment. This means an OTP
is now increasingly paired with a second check, such as a PIN or
biometric, making the overall system stronger even when any single
code has a short life.
OTPs are used across many types of platforms today, from banking
and UPI to online services and account registrations. When you
complete a lotus365 signup,
for example, you will receive an OTP to confirm that your mobile
number belongs to you before the account is created. Equally,
each time you do a lotus365 login
from a new device, a fresh OTP adds a second identity checkpoint.
What to Do If You Already Shared Your OTP
If you realize you gave an OTP to someone you should not have,
every second matters.
Call your bank’s toll-free helpline right away. Most Indian banks
can block a transaction or freeze UPI access within minutes of a
report. Do not wait to see if something bad happens.
File a complaint on the National Cyber Crime Reporting Portal,
the official government platform for reporting digital fraud in
India. The national cybercrime helpline number is 1930 and works
around the clock.
Change your UPI PIN and mobile banking password immediately.
If the account linked to your UPI is a savings account, ask
your bank to temporarily pause outgoing transfers while the
complaint is being reviewed.
The RBI has proposed a compensation framework that would offer
relief even to those who shared their OTP with a fraudster, with
a proposed cap of Rs 25,000 or 85% of the fraud value, whichever
is lower. This proposal had not come into full force as of October
2026, so quick action on your part is still your strongest line
of defence.
The short life of a one-time code is the whole point. It is a
narrow window that only you, acting quickly and quietly, can use.
Treat every OTP like a secret that expires the moment it is said
out loud, and the protection stays exactly where it should be.
