3 ms·

That's not the same thing! Here the scammer's app is saying "enter the one-time token generated by your device", then passing that on to the phisher. Your quote

• jrochkind1 5y ago
  From the OP: > OTP Agency customers would enter a target’s phone number and name, and then the service would initiate an automated phone call that alerts that person about unauthorized activity on their account. The call would prompt the target to enter an OTP token generated by their phone’s mobile app (“for authentication purposes”) What are you saying is the distinction that an ordinary user should be expected to distinguish, between a phone call that says it's from your bank alerting you to fraud and asking you to read back a 2FA code, and... a different kind of phone call that says it's from your bank alerting you to fraud and asking you to enter an OTP code in a different way? It's a pretty similar thing. In these particular cases, you and I could realize that a bot asking you to use keypad to enter the code is more suspicious than a human asking you to read it. But it's not like humans can't scam you too, as in the other story I linked to from krebs. And it's all a bit subtle and overwhelming for the average user (who of course encounter bot voice systems all the time when dealing with 'legitimate' businesses these days).