Will O2 ask for a one time passcode that they text when you call them?

[K_T]

I believe my mum has been scammed. Someone reporting to be from "O2" called her offering reduced billing for a period of time. Unfortunately she went through all steps with them, including reading out a one time passcode that was texted to her.
When she told me I had her call O2 herself using 202 from her handset, because it sounded like a scam to me. The operative she spoke to said that a scam had been committed and gave her a reference number which all seems OK. However during this interaction she was again texted a one time passcode to read out. The operative said that if O2 call you they would never ask for such a passcode, however if you call them they may. I am wondering is that correct? It occurs to me now maybe I should have had my mum ring from a different phone altogether using 0344 809 0202. Could the scammers have set something on her phone so that now ringing 202 is actually going back to them instead of really reaching O2?

[Bambino]

@K_T You are correct. Your mum has been scammed. See the links below: 

Block the number and report it free to 7726.

O2 advice here:

https://www.o2.co.uk/help/safety-and-security/phishing-and-smishing-advice
https://www.o2.co.uk/help/safety-and-security/unwanted-calls-and-messages
https://www.actionfraud.police.uk/

How to block a number:

https://www.samsung.com/us/support/answer/ANS00062352/

https://support.apple.com/en-us/HT201229

[K_T]

@Bambino 

Thank you very much for the reply.  As you say I am pretty sure she was scammed.  My question is more to do with how I had her report this to O2.

Once I believed that she had been scammed I got her to call O2 using 202 from her handset.  The person she spoke to still asked her to confirm a onetime passcode that was texted to her.  I want to confirm that it is normal when YOU initiate a call to O2 that they will ask you to confirm a onetime passcode that they text to you.

The reason I am curious is that it occurred to me later that she was dialling 202 from the phone that the scammers called her on.  She is elderly and wasn't very clear on exactly what the scammers had her go through, so I wondered could they have set the phone to call them when dialling 202 instead of O2?

The first link you provided does say to use 202 OK, but do you think it would make sense to call back on a completely different telephone using number 0344 809 0202 (e.g. using landline), just to check the scam notification was received OK?

[MI5]

@K_T 

If you call O2 it is OK to give out the code.

If someone calls you, NEVER give out the code.

They cannot do anything to your phone to intercept calls, so calling 202 is safe.

[K_T]

@MI5 

Thank you very much that is appreciated 🙂

[Bambino]

@K_T I'd  be more worried about the information the scammers now hold about your mum because she gave them the code. Contact her bank if you think she may have given out financial information. They can help protect her account and stop transactions.
Change her account and online account passwords. Not just on O2. All of them.

[K_T]

@Bambino 

Cheers for the additional pointers.  I specifically asked her about banking info and she definitely didn't give any out.  She called her bank anyway just to make sure there were no odd transactions and to make them aware.

Really appreciate you both, @Bambino & @MI5, taking the time to shout in with your thoughts and info!

[japitts]

Most reputable organisations will include on their OTPs, a wording to the effect of "don't give this code to anyone who you're not expecting to ask for it"

[MI5]

Indeed, as I possted on a similar thread earlier.