“NCA investigators said more than 12,500 people were targeted by OTP Agency users during the 18 months the service was active.”
OTP Agency took a stolen login plus a phone number and placed an automated call warning the victim about fraud, then relayed the SMS code they typed straight to the scammer. It launched in November 2019. Three men aged 19 to 22 pleaded guilty. The SMS code banks still treat as proof of identity loses to a robocall pretending to be the bank.