OTP Fraud: Why No Bank or Officer Ever Asks for Your OTP

An OTP arrives when someone is trying to move your money. If that someone is you, you type it. If it is anyone else, the correct action is to do nothing. Every OTP fraud in India is a story, told quickly and confidently, whose only purpose is to make you read those six digits to a stranger. The stories change every season. The ending never does.

This explainer is for the person who wants to understand why the rule is absolute, and for the relative who needs a short way to say it: OTP mat do. Not to the bank, not to the police, not to the courier, not to the nice woman from the "RBI".

What an OTP is, and why it is the whole game

The one-time password is the second lock on a transaction. Your card number, CVV and expiry, or your net-banking password, are the first lock, and all of those leak. They are sold in bulk from breached merchants, skimmed at petrol pumps, copied from photographs of cards. The OTP is different: it is generated for a single transaction, sent only to your registered phone, and expires in minutes. A criminal who holds everything else still cannot move a rupee without it.

That is why the fraud is aimed at you rather than at the bank. The scammer sets up the transaction, which triggers the real OTP to your real phone, and then persuades you to say it out loud. The bank's system sees a correctly entered code and approves the payment. From the bank's side, you authorised it. That framing is what you will later have to fight.

The OTP fraud stories, and where each one goes

Almost every OTP fraud uses one of a handful of scripts. Learn the shape and you will recognise new costumes.

The fake bank call

"This is the SBI card division. There is a suspicious transaction of ₹49,999 on your card. To block it, confirm the OTP we have just sent." The OTP you receive is for a real purchase the caller has just initiated. Reading it out completes the fraud you think you are stopping. Variants: "your card will be blocked", "your reward points expire today", "your KYC is incomplete". Banks do send alerts, but never ask you to read an alert back to them.

The refund that needs "confirmation"

You complained to Swiggy, Zomato, Amazon or a bus-booking site, or you searched for a customer care number and found a planted one. The "executive" is processing your refund and needs the OTP "to credit the amount". A refund never requires an OTP from you; the merchant pushes it back to the original payment method without any action on your side.

The screen share

Instead of asking for the OTP, the caller asks you to install a screen sharing app "so I can see the error". Now they read the OTP off your screen themselves. The outcome is identical; the only difference is that you never said the digits. We cover this in screen-sharing app fraud.

SMS forwarding malware

A file sent on WhatsApp ("Bank KYC update.apk", "Traffic challan.apk") asks for SMS permission on install. It then forwards every OTP to the gang silently. You never receive a call at all. This is why an OTP you did not request is an emergency, and why installing anything from a chat is the mistake that precedes the loss.

The officer

The "police", "customs" or "income-tax" version wraps the same request in fear. You are told your Aadhaar is linked to a crime and must "verify" your accounts; the verification is an OTP. No investigating agency verifies anything through OTPs, and no court or officer takes money by phone. Our digital arrest explainer covers that script in full.

Why no bank or officer will ever ask

Three reasons, and they are worth understanding rather than just believing.

First, the OTP is meaningless to the bank. The bank generated it. Its staff can see whether a transaction was authenticated without ever hearing the code from you. A request for the OTP can only come from someone who is not the bank.

Second, every bank's own terms and every RBI customer-education campaign state that the OTP must never be shared, and bank staff are trained on it because asking would be a disciplinary matter. The same applies to UIDAI for Aadhaar OTPs, to the income-tax department's e-filing portal, and to NPCI for UPI.

Third, investigating agencies work through notices, summons and physical presence. They do not have "verification desks" that process OTPs. If an officer calls, they can wait while you visit the station.

What to do if you shared it

Act in this order, and do not wait to see whether money actually goes.

Liability depends on the date you write. Under the RBI's 6 July 2017 circular on unauthorised electronic banking transactions, a customer who reports within three working days of the bank's alert bears zero liability for third-party fraud; from day four to day seven it is capped between ₹5,000 and ₹25,000 by account type; after that the bank's board-approved policy decides. (Source: RBI circular DBR.No.Leg.BC.78/09.07.005/2017-18.)

Banks reject many OTP cases as "customer-induced". The argument back is that deception by a stranger is third-party fraud, which the circular covers, and that you took every step the bank asks of its customers the moment you realised. The Ombudsman complaint guide explains how to make that case after the bank's 30 days run out. Full reporting steps are on our reporting page.

If you lost money, one more call is coming. Someone will ring claiming to be a "recovery agent", a "cyber lawyer" or from a "bank reversal desk", knowing your exact loss, and will ask for a fee to retrieve it. That is the same gang, or one that bought your details. No agency contacts victims unasked and nobody can guarantee a refund.

Reducing how often the question even reaches you

You cannot stop the calls entirely, but you can cut their number and their power. Use the phone's built-in spam filter or Truecaller to screen unknown numbers. Report fraud numbers on Chakshu at Sanchar Saathi, which leads to disconnection. Check how many SIMs are issued in your name on TAFCOP, because a stranger's SIM in your name is how an OTP gets diverted; our SIM swap explainer covers that route. Move email and important accounts to an authenticator app where the service allows it, so codes stop travelling by SMS. And read the phishing, vishing and smishing guide for the messages that set these calls up. The broader category is described on the phishing and vishing page, and unfamiliar terms are in the glossary.

If you would rather someone handled the bank correspondence and follow-ups, our financial fraud response service does it for a fixed fee agreed in advance.