Login or reset code
Someone could try to access the account or replace its password. Check sessions, contact details and recovery settings.
Account safety response
Shared a Cricket ID OTP? What to do next
The right next step depends on what the code approved: a sign-in, password reset or payment. Stop sharing codes and check the relevant account through a verified channel.
Do this first: end the conversation with the person who requested the code. Do not share another OTP or click a recovery link they send. Open the known website or official app independently and check recent activity. If a bank or payment code was involved, contact the bank or payment provider immediately through its official channel.
On this page
First, identify what the OTP was for
Read the original message without following its links. It may say whether the code was for login, password recovery, changing account details or a payment. A code's short expiry does not prove that nothing happened: someone may have used it while it was valid. If the message is unclear, check the account and contact verified support. Learn the difference between an account ID, password and OTP.
Bank or payment code
A transaction or payment-setting change may need urgent attention from the bank or payment provider.
If you can still sign in
- Use a trusted device and verified address. Type the known website address yourself or open the official app. Do not use the link sent by the person who requested the OTP.
- Change the account password. Make it long and unique. If you reused that password elsewhere, change it on those accounts too.
- Sign out other sessions if the service provides that option. Remove unfamiliar connected devices or apps.
- Check recovery details and activity. Review email, phone number, recent logins, messages and transactions for changes you did not make.
- Secure the associated email. Check its password, multi-factor authentication, recovery details and forwarding rules.
- Tell verified support. Use the contact method published on the genuine service website. Explain which kind of OTP was shared and when, without sending another code or your password.
If suspicious access is visible, follow the fuller hacked-account recovery checklist.
If you cannot sign in
Use the verified service's published account-recovery route. If the registered email or phone was changed, report that change to its official support team and secure the associated email through the email provider's own recovery process. Do not pay an unknown “recovery agent” or give them a new OTP. If you still control the registered contact method, the safe password-reset guide explains the normal recovery flow.
If the OTP was for a bank or payment action
Contact the bank or payment provider immediately using its official app, card, statement or independently verified website. Ask it to review the transaction and explain available protective steps. If cyber financial fraud occurred in India, call the national cybercrime helpline 1930 promptly and report the incident at the National Cyber Crime Reporting Portal. An OTP shared for a payment needs bank-side action; changing a Cricket ID password alone may not address it.
Save evidence without sharing more secrets
- The original OTP message, including what action it described and its time
- The chat, caller number, profile or website that asked for the code
- Login alerts, changed-account notices or transaction references
- The time you contacted verified support, the bank or the reporting portal
Keep the originals where possible. When reporting, use only official channels and share the minimum information needed. Do not post an OTP, password, identity document or full card details publicly.
How to avoid a second scam
A person may contact you again claiming they can “reverse” the first code or recover the account for a fee. Do not send another code, install a remote-access app or transfer money to a personal account. Verify any support contact independently. For website checks, use our fake Cricket ID website guide.
Quick questions
Is an expired OTP harmless?
Expiry stops future use of that code, but it does not undo anything approved while the code was valid. Check the account or payment activity.
Should I request a new OTP immediately?
Only start a new login or recovery request on a verified page when you need it. A new code is not a substitute for checking sessions, account changes or transactions.
Can support ask me to read out the new OTP?
Do not read out or forward an authentication code. Enter it only on the verified page for an action you initiated.
Official safety references
India's CERT-In cyber-safety booklet warns against sharing OTPs and advises prompt action after an incident. The National Cyber Crime Reporting Portal provides reporting routes. For general account-recovery steps, see the US Federal Trade Commission's hacked-account guide. Recovery options vary by service.
Continue learning
Read the complete Cricket ID guide, learn what passwords and OTPs do, use the hacked-account checklist and follow the 10-point website safety checklist.