topic Re: One time codes. in Discussions & Feedback

One time codes.

KevBe900 — Mon, 03 Jun 2024 14:05:59 GMT

Everyone including O2 tell you never to repeat back a one time code as it could give a scammer access to your account. When you contact O2 they use the code as a verification and ask you to repeat it back.... confusing for people! Come on O2 think of another way to verify a customer that doesn't involve a practice which we know is used by scammers and can cause anxiety to costomers.

Re: One time codes.

MI5 — Mon, 03 Jun 2024 14:22:11 GMT

@KevBe900

The warning actually says "if someone is calling you asking for the code" not if you have called O2.

Re: One time codes.

pgn — Mon, 03 Jun 2024 15:17:38 GMT

In my experience, when calling O2 CS, they have asked me for 2 characters from my memorable word (first pet, favourite team, etc), tbh.

This is accessible in your MyO2 if you have forgotten it, @KevBe900 - but to be asked for your password or the PIN just sent to you, yes, confusing, I will admit.

Re: One time codes.

Bambino — Mon, 03 Jun 2024 15:31:27 GMT

The basic rule of thumb should be, if you haven't initiated the call, you can't be certain if the call is genuine or not, therefore never give out personal information, or repeat codes back to the caller. If you do it's a surefire way of finding yourself in the middle of a scam and a great deal of bother. Phone scams have reached epidemic proportions and are only getting worse. The phone networks have yet to come up with a foolproof solution. We should not be relying on the networks protecting us. We need to be proactive and protect ourselves. If I don't recognise the number, I don't answer the call. If it's important and genuine, the caller will leave a voicemail. If they don't, I block the number.

Scammers rely on people who are trusting and not savvy to the pitfalls. Sadly, no matter how many times warnings are given, some still fall into the trap.

Re: One time codes.

KevBe900 — Mon, 03 Jun 2024 19:28:46 GMT

Yeah they asked me for characters from my memorable word as well as the one time code.

Re: One time codes.

pgn — Mon, 03 Jun 2024 19:48:20 GMT

Colour me shocked, @KevBe900.

Their own instruction says:

"*Be alert to fraud* NEVER share this code, including with O2 staff...":

It should be 2 or 3 characters from the answer to your security question.

@Dave-O2 - any feedback from O2 on this, please?

Re: One time codes.

pgn — Mon, 03 Jun 2024 19:49:26 GMT

@MI5 wrote:
@KevBe900
The warning actually says "if someone is calling you asking for the code" not if you have called O2.

You sure?

Re: One time codes.

MI5 — Mon, 03 Jun 2024 20:07:14 GMT

Yes. Read the first warning.

The second text has already been answered elsewhere by @Dave-O2 confirming that it refers to someone calling you alleging to be O2.

Re: One time codes.

pgn — Mon, 03 Jun 2024 20:21:44 GMT

Then we defer to Dave, now he has been tagged in. T'wouldn't be unlike O2 to send mixed messages.

Re: One time codes.

Dave-O2 — Tue, 04 Jun 2024 09:21:05 GMT

Thanks for the tag @pgn

As suggested above the instructions in the SMS are only relevant when you've received a call.

This is to protect customers from any Vishing scam attempts.

Re: One time codes.

MI5 — Tue, 04 Jun 2024 10:02:23 GMT

As you said previously @Dave-O2

Thanks for confirming 👍

Re: One time codes.

pgn — Tue, 04 Jun 2024 12:36:23 GMT

Thanks, Dave.

Still room for improvement, admittedly:

1. I call 202, my call is answered. I am asked to confirm my name, address and postcode and that I am the account holder.

2. "Next, we need to ask you to clear security"

3. What are the 3rd and 5th letter in your memorable answer? a b

4. You will receive 2 x SMS, please read me the the 2nd and 6th digits of the PIN in the second SMS. c d

No conflict there as I've adhered to the guidance "NEVER share this code, including with O2 staff."

I hasten to add, with O2 Social Media team, I have never been asked to comply with my Step 4 above.

Of course, the above presupposes the CS agent on the VMO2-side does not have the memorable answer to your Security Question plainly visible to them on their screen, but is being asked by the system on the VMO2 side to input the 3rd and 5th letters of it... but who knows?

Thanks, good discussion points. Bottom line is to be attentive to what is being asked and how it is asked.