Initiate a transaction, then phish him through email with any good reason to get him to submit the OTP code in any form, like pretending you're the bank.
But not 50mill, thats way too high my friend.