The OTP Read Out Over the Telephone
On 12 June a wheat farmer holding a Kisan Credit Card walks into a rural branch at 4 p.m. He says a man who introduced himself as an officer of the bank's 'KCC verification cell' telephoned that morning and told him his Aadhaar seeding had failed. He was persuaded to install a screen-sharing application sent by a link on WhatsApp and, while the caller watched his screen, to read out the six-digit code that arrived by SMS. Three UPI transfers of ₹6,000 each left his savings account for two different wallets between 11:40 a.m. and 11:52 a.m. He has not telephoned anyone else, has not reported the matter to the police and has not used the 1930 helpline. The branch has a manager, a business correspondent and an internet kiosk, but no cyber cell. The customer wants to know who will bear the ₹18,000 loss and what he must do today.
1. Who bears the loss? Answer with the reasoning, not just the conclusion.
Read the worked answer
On these facts, the customer bears the ₹18,000 already transferred - but only that.
The RBI limited-liability framework gives zero liability where an unauthorised transaction results from a third-party breach in which the customer had no role, provided the bank is notified within three working days. Here the customer himself installed the remote-access application and read out the OTP. Sharing payment credentials is customer negligence, and negligence breaks the zero-liability protection: the customer bears the loss incurred before the bank is informed.
Three qualifications that a one-line answer misses:
- The clock starts at notice, not at fraud. Once he gives a written complaint, any further debit from that account is the bank's liability, so the bank must block UPI and flag the account immediately.
- Reporting within three working days still matters, because it preserves his position on any reversal the wallet issuers or the bank can achieve.
- The bank cannot use his negligence as an excuse for inaction. It must still act on the complaint, give an acknowledgement with date and time, and record the notice in the complaint register.
So: the loss stays with him, the duty to act shifts to the branch the moment he reports.
2. Set out, in order, what must be done today, and say why the order matters.
Read the worked answer
Sequence, because the window closes by the hour.
- Block the channel first. Disable UPI on the account and register the two beneficiary handles as suspicious in the core banking system. Money still sitting in a wallet can be frozen; money withdrawn as cash cannot.
- Use the golden hour. Dial 1930 and file on the national cybercrime portal so the transaction details enter CFCFRMS and the wallet issuers are asked to freeze the credits. Three transfers only sixteen minutes apart are the strongest evidence available.
- Take the written complaint at the branch and hand over a stamped acknowledgement with date and time. That acknowledgement is the proof of when the bank was informed and therefore the dividing line of liability.
- Preserve evidence: do not uninstall the app, do not delete the WhatsApp link, the call log or the SMS; note the caller's number.
- File an FIR at the local police station, and pursue the bank's internal ombudsman route if the complaint is not resolved.
Why order matters: steps 2 and 3 are time-stamped, and everything later in the dispute depends on those two stamps.
3. Name the technical nature of the fraud for the branch's advisory notice, and give three practical rules the branch should give its other KCC holders.
Read the worked answer
Technical description: a vishing call (voice phishing) combined with a malicious link on WhatsApp that installed a screen-sharing or remote-access tool, plus OTP capture. The link is the delivery mechanism, the screen-sharing app is the remote access, and the OTP read out over the phone is the credential theft. The WhatsApp link, not the bank's systems, is where the compromise occurred - which is why the bank's own servers show a legitimately authenticated transaction.
Three rules for the advisory notice, written for farmers rather than for auditors:
- The bank never asks for an OTP, a PIN or a CVV, and never asks you to install an app. Anyone who does is a fraudster, whatever number is displayed on the screen caller ID.
- Do not install any application from a link sent on WhatsApp or SMS. Screen-sharing and 'accessibility' permissions let a stranger see and operate your phone; if such an app is already installed, remove it and change the UPI PIN.
- Act within the hour, not the week. Call 1930 and inform the branch the same day; keep every SMS and the acknowledgement slip.
The notice should carry the branch's own landline so a farmer has a number he can verify against, instead of trusting an incoming call.