Fake Checkout ‘Identity Checks’ Designed to Steal OTPs: Avoid the Trap

Online scammers are getting bold: some now insert fake “identity check” steps right into the checkout flow to steal the one-time passcodes (OTPs) that protect your bank, credit card, or payment accounts. The page can look convincing—brand colors, logos, and even your correct cart total—yet a single prompt for an OTP can hand criminals everything they need to finish a fraudulent purchase or take over your account. This guide shows you exactly how these traps work, how to spot them, and what to do if you almost fell for one.

What is a Fake Checkout “Identity Check”?

A fake identity check is a fraudulent step added to an online checkout that asks you to verify your identity by entering a code sent by text, email, or authenticator app. Unlike legitimate bank or card issuer challenges that occur on their own secure domains, these fake prompts appear on the merchant site (or a cloned copy) and are designed to capture the code in real time.

Scammers use several methods to stage these attacks:

• Phished store pages: You click an ad or email leading to a perfect-looking copy of a retailer’s site. The entire checkout is malicious.
• Injected overlays on real sites: A compromised browser extension or malicious script injects an “extra verification” popup into a legitimate checkout.
• Live social engineering: A fraudster on chat or phone claims a transaction is “flagged” and asks you to read back a code “to complete or cancel” the order.

Why Thieves Want Your OTP

Most banks, payment wallets, and retailers use multi-factor authentication (MFA) to stop unauthorized logins or transactions. An OTP is the second factor—something only you should have. If criminals obtain your username/password through a breach or phishing, the OTP is the last lock. Capturing it in the moment lets them:

• Complete a purchase using your card or stored wallet.
• Change account details like email, phone, or shipping address.
• Enroll new devices or add payment methods to your profile.
• Reset passwords and lock you out.

How the Scam Typically Unfolds

1. Lure: You’re drawn to a sale via search ads, social media, or email. The link points to a cloned site or a compromised page.
2. Convincing checkout: The cart, product images, and prices look normal. A banner may mention “enhanced security” or “3D Secure update.”
3. OTP prompt appears on-page: It says “To protect your account, enter the 6-digit code sent by your bank” or “Verify identity to proceed.”
4. You receive a real code: Because the attacker is trying to log in or charge your card in the background, your bank legitimately texts a code to you.
5. Real-time relay: You type the code into the fake prompt. The attacker immediately uses it to pass the bank’s challenge and complete the fraud.
6. Cleanup: The page may show an error or “payment failed,” pushing you to retry while the thief rushes through their transaction elsewhere.

Red Flags to Spot Fake Identity Checks

• OTP request appears inside the merchant page rather than redirecting to your bank’s known domain (e.g., an embedded frame that doesn’t show a bank URL).
• Brand mismatch: The popup shows a generic bank logo or the wrong issuer compared to your actual card.
• Grammar or layout issues: Odd capitalization, spacing, or non-standard phrases like “Pass your identity now.”
• Unnecessary information: Asking for full SSN, card PIN, or recovery codes to “verify identity.” Legitimate 3-D Secure challenges do not require those.
• Pressure language: “Enter within 60 seconds or your order is canceled” or “Account suspension imminent.”
• Address bar anomalies: Misspelled domain, extra words, unfamiliar TLDs, or a page hosted on a link shortener or content-sharing site.
• Multiple back-to-back OTP requests: Repeated prompts signal a brute-force or relay attempt, not normal checkout.

Legitimate vs. Fake: Key Differences

• Where the challenge happens: Real bank authentication either:
  • Redirects you to a bank/issuer domain you recognize, or
  • Uses a clearly branded 3-D Secure component with the issuer’s name, ending in a trusted domain.

  Fake prompts keep you on the retailer’s domain or show an unbranded overlay.

• What’s requested: Real challenges ask for a one-time code or to confirm in your bank app. They do not ask for full SSN, card PIN, or your online banking password.
• Who asks for the code: No employee, chat agent, or support rep will ever ask you to read a code to them. The code is for you only.
• How it looks: Real flows typically include issuer name, partial card number masking, and legal text. Fakes often use generic “Security Check” titles.

How to Handle a Suspicious Checkout Prompt

• Pause immediately. Do not enter the code. Close the tab.
• Verify the URL. Manually type the retailer’s address into your browser, or use a saved bookmark. Avoid clicking ads for re-entry.
• Check your bank app. Look for pending purchase notifications. If you see an unknown attempt, lock the card right away.
• Use your bank’s app confirmation. If your bank supports “approve in app” rather than SMS, prefer that method. Don’t approve prompts you didn’t initiate.
• Try another device or network. If the same odd prompt appears across devices, contact the retailer using a known support channel.

If You Already Entered a Code: What to Do Next

1. Contact your bank or card issuer now. Report possible compromise and ask for a temporary hold or replacement card if needed.
2. Change passwords for the retailer account and any reused passwords elsewhere. Enable strong, unique passwords using a manager.
3. Secure MFA: Switch from SMS to an authenticator app or hardware key where possible, and review your recovery options.
4. Review transactions and alerts: Scan recent and pending charges. Turn on real-time notifications for card activity, new payees, and logins.
5. Check email forwarding and filters: Attackers sometimes add rules to hide security alerts. Remove any suspicious rules.
6. Watch for follow-on fraud: Expect new phishing attempts pretending to be your bank or the retailer. Treat unsolicited calls or texts with caution.

Prevention: Practical Steps That Work

• Start from trusted entry points: Type the retailer’s URL, use your saved bookmarks, or their official app. Avoid shopping via search ads or unfamiliar links.
• Use payment alternatives with strong buyer protection: Virtual card numbers, privacy cards, or wallet tokens can reduce risk if a merchant is compromised.
• Harden your browser: Keep it updated, disable or remove extensions you don’t need, and use built-in tracking protection. Be cautious with coupon or shopping extensions.
• Prefer app-based approvals: Authenticator apps or bank app push approvals are harder to relay than SMS codes.
• Enable comprehensive alerts: Turn on notifications for transactions, new device sign-ins, password changes, and address or phone updates.
• Segment email addresses: Use unique aliases for shopping so you can spot which merchant might be compromised.
• Freeze your credit when not applying: A freeze won’t stop card fraud but does block new-account identity theft.

Understanding 3-D Secure (and Its Imitations)

Many card issuers use 3-D Secure (3DS) to challenge suspicious transactions. In a normal 3DS flow, the checkout either redirects you to your issuer’s page or shows a clearly branded component that references your bank and card. You may confirm in your banking app or enter a short code. Scammers copy the look but can’t replicate the domain or the secure handoff. That’s the critical tell—always check the address bar and who is actually asking for the code.

MFA Fatigue and Social Pressure Tactics

Attackers sometimes bombard you with repeated approval requests or OTP prompts to wear you down. They may call posing as “Fraud Prevention,” instructing you to read the next code to “block” a bad charge. Remember: if someone asks for the code, they are the threat. Hang up, call the number on the back of your card, and confirm directly.

How These Scams Find You

• Leaked passwords and emails: Breaches supply login pairs that criminals test at major retailers.
• Data broker profiles: Publicly exposed contact details make targeting easier for convincing texts and calls.
• Malvertising: Fake ads hijack brand searches with sponsored results that lead to cloned sites.
• Compromised plugins or scripts: Third-party tools on legitimate stores can be abused to inject malicious overlays.

Reduce Your Exposure Surface

• Remove unnecessary personal data online: Opt out of data broker sites that list your phone, email, and address to reduce targeted phishing.
• Use unique passwords everywhere: Password managers generate and store long, unique credentials that blunt breach fallout.
• Rotate numbers or use masked emails: Some services let you create disposable addresses and phone numbers for signups.
• Monitor for changes: Keep an eye on new credit inquiries, new accounts, or sudden address changes linked to your identity.

When Monitoring Helps

Because OTP theft often precedes payment misuse or account takeovers, timely alerts are essential. Consider a service that centralizes credit, identity, and transaction monitoring to catch suspicious activity early and guide next steps. If you want a single place to watch for credit report changes, new account openings, and identity-related alerts, see our overview of SmartCredit for privacy, credit monitoring, and identity protection.

Quick Checklist: Before You Enter Any OTP During Checkout

• Is the OTP prompt on your bank’s domain or approved 3DS page, not just a store overlay?
• Did you initiate the action (login, purchase) a moment ago?
• Is the issuer branding correct for the card you’re using?
• Is the site URL spelled correctly and using HTTPS on the expected domain?
• Is anyone asking you to read the code aloud or send it via chat? If yes, stop.

What Retailers Can Do (and What You Can Ask For)

• Support app-based approvals and tokenized payments to reduce SMS reliance.
• Use clear, consistent 3DS experiences so customers recognize the legitimate flow.
• Publish a “how we verify” page that states what you will and won’t ask for.
• Audit third-party scripts and extensions to prevent malicious overlays.
• Offer virtual cards or one-time checkout links for higher-risk transactions.

Conclusion

Fake checkout “identity checks” work because they look routine and arrive at the exact moment you expect security to be involved. The fix is simple, but firm: only enter verification codes on trusted issuer pages or in your bank app, never inside a generic store popup or to a person who asks for it. If something feels off, stop, close the tab, and verify through known channels. Strengthen your defenses with unique passwords, app-based MFA, and real-time alerts, and you’ll make OTP relay scams far less likely to succeed.