A related story coming out:
If you bank via the internet, beware of the latest scam - fraudsters may try to get you to receive by email the one-time password (OTP) your bank issues so that they can intercept it. Once criminals have your OTP, they can use it in combination with your account log-on details to transfer money out of your account.

In an attempt to stop online fraud, the banks issue OTPs, which you must enter each time you want to amend your contact details or change your beneficiaries. This password is valid for a single internet banking session only.

Fraudsters are now trying to intercept these OTPs so that if they manage to obtain your account log-in details, they can add themselves as a beneficiary and transfer money out of your account.

The major banks are taking steps to address the problem by encouraging you to receive your OTP by SMS rather than by email.

They say no South African bank will ask you to verify your personal identification number (PIN) in an email. If you receive such an email, you should not respond as it is likely to be from a fraudster after your log-in details.
from Personal Finance here
Is there a way fraudsters could intercept an OTP and use it before you do?