TRAI to change OTP format so code no longer shows in phone notifications

Online fraud cases are rising by the day. To protect people from the widening net of cyber fraudsters, the Telecom Regulatory Authority of India (TRAI) is preparing to take an important step. A major change is likely in how one-time passwords (OTPs) are sent and in their format.

At present, many users read the OTP in the notification itself as soon as it arrives on their mobile and proceed, and fall victim to fraud. To stop this, TRAI has drawn up some strict rules.

The first change concerns the notification preview. In future, an OTP received on the phone will not appear directly in the notification. The user will have to open the messaging app to see it. This will curb those who steal OTPs by watching a phone or from a distance.

The second change concerns format. A uniform, fixed format will be created for banks, e-commerce companies and digital platforms. It will state clearly whether the code is for logging in, for a payment or for some other purpose.

The third point concerns the identity of the company and the validity period. The message will carry the name of the company sending the code and will also say how long the code will remain valid.

According to Ministry of Home Affairs data, about 2.62 lakh complaints were registered on the National Cyber Crime Reporting Portal in 2021. By 2025 the figure has risen to 24.02 lakh. The amount lost to online fraud has also risen from Rs 551 crore to Rs 22,495 crore. Against this background, the TRAI rules are considered significant.

Cyber security experts say that changing the format alone will not stop cyber crime completely overnight, because fraudsters keep finding new methods. Fraud is now carried out not only through SMS but also through WhatsApp and other social media platforms.

Even so, experts say these changes will help considerably in raising public awareness. They advise people not to share an OTP thoughtlessly with an unknown person or one received over the phone. If a suspicious message from a bank or payment app arrives, they should check their account immediately and, if necessary, block payments at once.