The bank call, the free-laptop link and the OTP
Rohit, an 18-year-old IT/ITeS student in Guwahati, receives a phone call from a man claiming to be from his bank's fraud department. The caller knows Rohit's name, the last four digits of his account, and says his KYC will be blocked today unless he installs a 'bank security app' from a link and shares the six-digit code that will arrive by SMS. Rohit has 8,000 rupees in the account, which is linked to his Aadhaar and receives his scholarship. Ten minutes earlier he had clicked a WhatsApp link offering a free laptop under a government scheme and entered his name, date of birth and mobile number. He has not entered any OTP yet. His friend says 'just share it, banks do this all the time'.
1. Identify the red flags in this situation and assess what information is already at risk.
Read the worked answer
The red flags are the unsolicited call, the artificial deadline ('today'), the request to install an app from a link, and above all the request for a six-digit SMS code. A genuine bank does not ask for an OTP or remote-access app to complete KYC. Knowing his name and the last four digits is not proof: those details are commonly exposed in data leaks and can be used to sound convincing. The free-laptop link is a second red flag because it collected name, date of birth and mobile number, which are useful for identity fraud and future targeted calls.
No OTP has been shared, so the account is not yet directly compromised by the caller. But the data already entered and the Aadhaar link raise the risk, and installing the app would give an attacker remote access. The friend's advice is wrong because familiarity with banking language is not verification.
2. List Rohit's immediate actions in priority order and explain why each one matters.
Read the worked answer
First, hang up and do not install the app or share the code. Second, contact the bank using the official number on the card, passbook or bank website, not a number given by the caller, and ask whether any KYC block or request exists. Third, check the account and UPI transaction history, and ask the bank to disable or reset UPI and card access if anything looks wrong. Fourth, change the banking password and any password reused elsewhere, and enable transaction alerts.
He should also uninstall anything already installed from the link, run a security scan, and check app permissions. Because his Aadhaar is linked, he should watch for unauthorised SIM or e-KYC requests. Reporting early matters because bank reversal and cybercrime tracing are time-sensitive; delay gives the attacker time to move money.
3. Two days later, 8,000 rupees is withdrawn even though Rohit never shared the OTP. What should he do, and what evidence should he preserve?
Read the worked answer
He should act immediately rather than wait for the bank to notice. Call the bank's official fraud line to block the card or account and dispute the transaction, then report on the national cybercrime portal and call the financial-fraud helpline 1930. Also file a written complaint at the local police station or cyber cell, keeping the acknowledgement. Speed matters because the 'golden hour' gives the bank and police the best chance to freeze the receiving account.
Preserve the original SMS alerts, call log, screenshots of the WhatsApp link and any app installation, bank statement pages showing the debit, the complaint numbers and the helpdesk ticket. Do not delete messages or reset the phone before a technician has checked it. If the bank says he authorised the transaction, the evidence of the fraudulent call and link is what supports the dispute; he should follow up in writing and keep every reference number.