I have received such a phishing call recently. The script went something along the lines of: "Hi, we need to authenticate a recent transaction of $high_value_

I have received such a phishing call recently. The script went something along the lines of: "Hi, we need to authenticate a recent transaction of $high_value_item, well send you a verification code to prove we are $company_x." <receipt of OTP code via SMS from $company_x> "Can you repeat the verification code to authenticate?" "Of course this isn't a scam, we must be $company_x, how else could I send you the verification code?" I can definitely see general members of the public falling for this sort of scam - because they are being led to believe it's not a one-time-password that they're relaying at all, and some organisations do use verification codes of that sort, although usually it's to verify ownership of a particular mobile telephone number when setting up an account or pairing an app or similar. I wouldn't expect non-technically savvy folk to immediately spot the difference between a verification code and a one-time-password. It might be good if the OTP SMS message had text along the lines of "Do not give this code to anyone under any circumstances, regardless of who they claim to be employed by." - not that I would expect it to help in all cases. (tbh - I was actually quite impressed, the English skills of the person on the other end of the telephone were significantly better than the average tech support call center person).