One Time Passcode

On this page

What is One Time Passcode? Open in new window

What this means to you Open in new window

Why was One Time Passcode introduced? Open in new window

Why we've introduced One Time Passcode Open in new window

Frequently asked questions Open in new window

What is One Time Passcode (OTP)?

OTP is used when making transactions online and accessing online accounts. We’ll send a randomly generated six-digit code to you via SMS or email. You’ll need to key in the OTP when prompted to continue, which must be used within 10 minutes before it expires. This will result in a more secure way for us to authenticate the cardholder identity.

What this means to you

To complete online transactions without disruption, all cardholders will need to provide us with a current mobile number or email address.

If this information is not provided, we won’t be able to deliver the OTP and authenticate the card user. This will prevent them from accessing their online accounts, making transactions online or carrying out any action through a remote channel.

If you received an email or letter from us regarding OTP, please provide the requested mobile numbers or email addresses on the attached form. Return the form to us according to the instructions given.

Alternatively, get in touch with us using the number on the back of your card.

Why was OTP introduced?

One Time Passcodes were introduced on 14th September 2019 as a part of the Payment Services Directive 2 (PSD2), to complete online transactions and to access some services. OTP's allow us to better protect our customers against Fraud.

Why we've introduced OTP

We need to implement a range of technical standards to comply with the requirements of the Payment Services Directive 2.

Strong Customer Authentication (SCA) is one of the requirements. SCA is a secure way of identifying the payer (customer) each time they:

Access their payment account online
Make a transaction online
Carry out any action through a remote channel.

This will allow us to better protect our customer against Fraud. SCA requires payers to complete two factors of authentication:

First Factor - using card details (long card number, expiry date and CVV number)
Second Factor - a One Time Password (OTP) verification.

One Time Passcode FAQ's

What do I need to register for One Time Passcode (OTP)?

Registration is not required for OTP Service. We'll send the OTP to your registered mobile phone number or email address.

Please ensure that you've registered a valid mobile number and email address with us. Contact us on the number on the back of your card to check or update your information.

Are there any service charges for using the OTP service?

The text messages are currently free of charge. However please note that your mobile network service provider may charge you for receiving a text message on your mobile phone and sometimes higher charges may apply if you are abroad. You are strongly advised to check your mobile network operator's tariff for receiving text messages.

The OTP service via email is free, no charges are applicable.

Why do I need OTP? What are the benefits?

Using an OTP provides extra protection against online fraud. If fraudsters obtain your card information, they won't be able to use it for online transactions without the OTP sent to your mobile phone or email address.

Does an OTP expire?

The OTP expires 10 minutes after we send it to you. If you can't enter the OTP to complete your transaction before it expires, you may have to restart the transaction.

We will block your card after three unsuccessful attempts. If this happens, please ring the number on the back of your card to get it unblocked.

Can I receive an OTP when I'm abroad?

If you are overseas and using overseas mobile service providers, the service provider may not support the receipt of international SMS. Remember to turn on your mobile phone and activate your roaming service to ensure you can receive the OTP SMS. Ask your telecommunication service provider for details.

What should I do if I've lost my mobile?

Report your loss to your mobile service provider immediately to suspend your mobile service. If your commercial or business card information is stolen, they won't be able to receive your OTP and use it for online transactions.

Can I refuse to use OTP?

No. As a part of the Payment Services Directive 2 (PSD2), we must introduce strong customer authentication. Using an OTP will be the only way to authenticate online transactions. So it's important to ensure your mobile phone number and email address registered with the bank is up-to-date.

I don't have a mobile phone. How can I verify my identity?

We offer email as an alternative to receiving your OTP by Mobile SMS. If you do not have a business mobile contact number, please provide us with your updated business email address.