The One-Time Passcode That Adds Your Card to a Criminal’s Digital Wallet

VERDICT: STRONGLY VERIFIED (V4)

A genuine one-time passcode can authorise the wrong thing if you misunderstand what it is asking you to approve.

CLAIM

Criminals can use card details entered into a fake shopping or delivery page to begin adding the victim’s card to a digital wallet on the criminal’s device, then trick the victim into supplying the OTP needed to complete wallet setup.

EVIDENCE

Which? documented the mechanism in 2025 after work involving Cifas, the Cyber Defence Alliance and UK Finance. Its investigation found that many card providers still offered SMS OTPs as one method of approving cards being added to digital wallets.

In July 2026 Which? documented a victim who lost more than £18,000 after fraudsters persuaded him to provide an OTP which they used to add his Revolut card to an Apple Pay wallet, followed by fraudulent spending.

TEST

The evidence establishes the mechanism and documented victim cases. The public evidence used here is principally consumer and industry investigation rather than a national police prevalence dataset, so TVD does not estimate how many UK victims have experienced this specific technique.

VERDICT

V4 — Strongly Verified.

How to prevent it

• Read the entire OTP message before entering or sharing the code.
• If the message says the code is for adding a card to Apple Pay, Google Wallet or another wallet when that is not what you are doing, stop immediately.
• Never assume a genuine bank OTP means the website that triggered it is genuine.
• If an unfamiliar wallet has been linked to your card, contact your card issuer immediately.

Warning signs

• An OTP message refers to adding your card to a digital wallet when you are only trying to make a purchase or delivery payment.
• A caller or webpage asks you to enter an OTP without clearly explaining the action it authorises.
• Your banking app shows a new wallet or device you do not recognise.

What to do if you responded

Contact your card issuer immediately, explain that your card may have been added to an unauthorised digital wallet, review recent transactions and ask the issuer to secure the card and linked wallet access.

Where to report it

Report unauthorised transactions to your bank or card issuer first, then use the appropriate official fraud-reporting route. See Fraud First Aid.

Sources: Which? investigations, August 2025 and July 2026, drawing on industry evidence and a documented victim case.

Evidence boundary: digital-wallet services themselves are legitimate. The fraud involves criminals abusing card-provisioning and social-engineering processes.