diff --git a/modules/creditmutuel/browser.py b/modules/creditmutuel/browser.py
index 7f583a3a3856c735882933b8455a4db1c75bb3f1..b73d25b3adacbb1e2a0b0e1117768359d8d0a0f3 100644
--- a/modules/creditmutuel/browser.py
+++ b/modules/creditmutuel/browser.py
@@ -343,6 +343,8 @@ def check_otp_blocked(self):
             raise BrowserUnavailable(error_msg)
 
     def handle_sms(self):
+        if not self.otp_data or 'final_url_params' not in self.otp_data:
+            raise BrowserIncorrectPassword("Le code de confirmation envoyé par SMS n'est plus utilisable")
         self.otp_data['final_url_params']['otp_password'] = self.code
         self.finalize_twofa(self.otp_data)