Why you got a betting OTP you never asked for

An unrequested betting OTP means someone, or a bot, entered your phone number on a login, registration or reset screen. The code alone does nothing until it is used, so never share it, never forward it, and check your accounts through the official app or site.

By WebTech Kenya Editorial (prepared with AI tools under our editorial policy) · Last updated 2026-10-17

What a one-time code is and what it proves

A one-time password (OTP) is a short code sent to your phone to confirm that the person at the screen controls that number. It is created when someone presses "send code" on a login, registration, password reset or payment screen. The system does not check who pressed the button.

So an unrequested OTP proves one thing: your number was entered somewhere. It does not prove that your account was opened, entered or emptied. The danger starts only if the code is used, and that usually needs you to hand it over.

Why it may have reached you

There are a few common reasons, and the table separates them by what you can see on your phone.

Credential stuffing means automated attempts that try email addresses or usernames with passwords leaked from other websites. If you reuse one password across services, one leak can open the others.

Rule one: never share the code

The code is the proof that you control the number. Anyone who receives it can act as you on that screen, and an operator's support staff do not need it to help you. Treat it like your wallet PIN: it is not shared with a caller, a friend, an agent or a person you met on a messaging app.

Scammers often phone just after the code arrives and say it was sent to you by mistake. The call exists to get the code from you, so end it. The guide on recognising a betting phishing SMS covers the other messages that pair with this trick.

What to do in the first ten minutes

1. Do not tap any link in or near the message, and do not reply with the code.
2. Open the operator's app or type its address yourself, if you have an account there. Look at recent logins, deposits and withdrawals.
3. If anything looks wrong, change the password from the real app, then follow what to do if a betting account is hacked.
4. Change the password on any other service where you used the same one.
5. Check your mobile money statement for payments you did not make.
6. If you have no account with that operator, do nothing with the code and report the registration (see below).

Habits that make stray codes harmless

Use a password for each betting account that you do not use anywhere else, and keep your phone locked with a screen lock. Install the operator's app only from an official store, as explained in the guide on spotting fake betting apps and APK risks, because a fake app can read incoming messages.

Keep a short note of which services hold your number. If you change number, update it with each operator so that old codes do not go to a stranger who inherits the line. Each time a code arrives that you did not ask for, note the sender name and the time: this makes any later complaint to the operator or the regulator much easier to explain.

What the rules say about operators and accounts

The Gambling Control Act, 2025 requires a licensee to register every player and hold an account for them (s.72(1)), and to require proof of age of majority before registering a player (s.72(3)). Where a licensee learns that a person gave false information at registration, it must cancel that registration (s.72(5)). An account opened with your number by someone else is therefore something the operator can be asked to close.

The Conduct of Gambling Operations Regulations, 2026 add security duties. Regulation 50 requires online platforms to be secure from cyber-attacks and hacking, and requires an incident response record of breaches and fraudulent digital activity. Regulation 91(2) requires a licensee to report fraud and malpractice to the Authority within twenty-four hours. These are duties of the operator, so they do not replace your own care with codes.

How to report it

Start with the operator's customer care centre: say which number received the code, the time, and that you did not request it. Ask in writing for confirmation that no account is linked to your number, or that it has been closed.

If the operator does not act, the Gambling Regulatory Authority takes complaints about betting and gaming on its toll-free line, 0800-723-770, or by email at [email protected]. If your personal data is being misused, see how to report betting data misuse to the ODPC. Your mobile network has its own fraud reporting channels: use the number printed on its official website or in its shop, not one from a message.

If the codes keep coming or your phone drops network without reason, read how to protect a gambling account from SIM swap and contact your network the same day.