will necessarily have a longer window of vulnerability if compromised before their use. In late 2005 customers of a Swedish bank were tricked into giving up their pre-supplied one-time passwords. In 2006 this type of attack was used on customers of a US bank. Standardization Many OTP technologies are patented. This makes standardization in this area more difficult, as each company tries to push its own technology. Standards do, however, exist – for example, RFC 1760 (S/KEY), RFC 2289 (OTP), RFC 4226 (HOTP) and RFC 6238 (TOTP). Use Mobile phone A mobile phone itself can be a hand-held authentication token. Mobile text messaging is one of the ways of receiving an OTAC through a mobile phone. In this way, a service provider sends a text message that includes an OTAC enciphered by a digital certificate to a user for authentication. According to a report, mobile text messaging provides high security when it uses public key infrastructure (PKI) to provide bidirectional authentication and non-repudiation, in accordance with theoretical analysis. SMS as a method of receiving OTACs is broadly used in our daily lives for purposes such as banking, credit/debit cards, and security. Telephone There are two methods of using a telephone to verify a user’s authentication. With the first method, a service provider shows an OTAC on the computer or smartphone screen and then makes an automatic telephone call to a number that has already been authenticated. Then the user enters the OTAC that appears on their screen into the telephone keypad. With the second method, which is used to authenticate and activate Microsoft Windows, the user call a number that is provided by the service provider and enters the OTAC that the phone system gives the user. Computer In the field of computer technology, it is known that using one-time authorization code (OTAC) through email, in a broad sense, and using one-time authorization code (OTAC) through web-application, in a professional sense. An email is one of the common ways of using OTACs. There are two main methods used. With the first method, a service provider sends a personalised one time URL to an authenticated email address e.g. @ucl.ac.uk, when the user clicks the URL the server authenticates the user. With the second method, a service provider sends a personalised OTAC (e.g. an enciphered token) to an authenticated email address when the user types the OTAC into the website the server