# AI tells a South African taxpayer to use FNB eFiling for SARS without mentioning the 30-second OTP expiry on FNB's banking app, causing failed submissions

- **ID:** `banking/fnb-otp-expiry-sars`
- **Domain:** banking
- **Category:** auth_error
- **Error Code:** `FNB-OTP-EXPIRED-30S`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

FNB's banking app generates OTPs with a 30-second validity window for eFiling authentication; if the user does not enter the OTP within 30 seconds, the SARS session times out and the submission is rejected

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| FNB Banking App v10.2 | active | — | — |
| SARS eFiling 2024 | active | — | — |
| FNB OTP Service 2.0 | active | — | — |

## Workarounds

1. **Before clicking 'Request OTP' on SARS eFiling, have the FNB app open and ready; click the button, immediately switch to the app, copy the OTP, and paste it within 30 seconds using a password manager** (92% success)
   ```
   Before clicking 'Request OTP' on SARS eFiling, have the FNB app open and ready; click the button, immediately switch to the app, copy the OTP, and paste it within 30 seconds using a password manager
   ```
2. **Use a secondary device (e.g., tablet) to display the SARS page while the phone shows the OTP, reducing switching time** (88% success)
   ```
   Use a secondary device (e.g., tablet) to display the SARS page while the phone shows the OTP, reducing switching time
   ```
3. **If the OTP expires, start a fresh SARS session by closing the browser tab, clearing cookies, and re-logging in before requesting a new OTP** (85% success)
   ```
   If the OTP expires, start a fresh SARS session by closing the browser tab, clearing cookies, and re-logging in before requesting a new OTP
   ```

## Dead Ends

- **** — The SARS session remains tied to the original OTP request; new OTPs still expire in 30 seconds and the session may lock after 3 failed attempts (90% fail)
- **** — FNB's SMS OTP also has a 30-second expiry for eFiling; there is no longer-lived alternative for SARS authentication (95% fail)
- **** — The SARS session token is invalidated after the first OTP request; a new session must be started from the SARS login page (85% fail)