I guess they just bruteforce OTP by sending all combinations of four digits to the server and eventually one works.