When the hacker hacked they don’t require any otp ady.
Last year on a night I suddenly received 4 consecutive sms saying my amb cc was charged usdxxx for purchased of iTunes gift card. And the fifth sms came in said the 5th transaction not successful coz too many similar transaction performed at the same time.

That time I did not even getting any otp from the bank. I immediately called the bank to check and they said those are genuine transactions and immediately I get them to block my card.

I told d bank it was not my authorised transactions and I didn’t even receive any sms otp. But they told me I can only submit dispute form which it might take 3-6 mths to investigate and come out the result.

I think that was too long so I immediately called apple helpline and informed them on my situation. After further checking they agreed to refund back the money to my credit card which was charged earlier.

So yeah when they hacked into ur cc they won’t need the otp for their spending or not sure now they bypass it