UNDERSTANDING OTP VERIFICATION: A SECURITY GUIDE