When a user tries to access a restricted service or perform a sensitive action, an OTP is generated and sent to their registered email address. The user must then enter this OTP within a specified time frame to complete the action. This mechanism ensures that even if a malicious actor gains access to the user's login credentials, they would still need the OTP to proceed.