SIM Swaps, UPI Device Registration and Twenty-Seven Complaints
Between 3 and 9 March a bank receives 27 complaints of unauthorised UPI debits ranging from Rs 4,800 to Rs 49,000, totalling Rs 6.31 lakh. In every case the customer's SIM had been replaced or ported out in the preceding 72 hours; the fraudster then installed the bank's UPI app on a new handset, entered the registered mobile number, received the SMS OTP on the swapped SIM, set a new UPI PIN and transferred funds to nine beneficiary VPAs. The bank's device-binding check is itself SMS-OTP based, and the core banking system does not query the telecom operator before a mobile-number change or a high-value registration. Complaints were lodged between 0 and 9 days after the debit: 6 customers reported within 24 hours, 11 within 3 working days, and 10 after 7 working days. The fraud team wants to reject the late complaints as customer negligence; the customer service head wants blanket refunds to protect reputation. Nine beneficiary VPAs are still active.
1. Classify liability for the three reporting groups under RBI's limited-liability framework, and state what provisional credit you would give and when.
Read the worked answer
Framework: zero liability where the deficiency lies with neither customer nor bank - a third-party breach - provided the customer reports within 3 working days. Where the customer is negligent, liability is capped per the bank's board-approved policy (commonly Rs 5,000 / Rs 10,000 / Rs 25,000 by account type and customer limit), with caps rising as reporting is delayed. The bank must give provisional credit within 10 working days of the customer's notification and close the case within 90 days; the burden of proving customer negligence is on the bank. Verify the current caps against the circular and the bank's policy before writing to customers.
Applying it:
- 6 reported within 24 hours, 11 within 3 working days: zero liability. There is no evidence these customers shared an OTP; the OTP went to a SIM controlled by the fraudster after a swap the customer did not request. Pay in full, provisionally within 10 working days.
- 10 reported after 7 working days: the cap applies only if negligence is established. Delay is a factor, but SIM-swap fraud is often discovered late because the phone shows no service. Investigate each: was there a bank SMS before porting, did the customer respond to a phishing call, when did they first notice? Absent evidence, pay in full and record the reasoning.
Rejecting the late complaints wholesale is the wrong answer - the bank carries the burden of proof, and a rejection without evidence invites ombudsman escalation and reputational cost far above Rs 6.31 lakh.
2. What controls would you implement in 90 days to break the SIM-swap chain, and which single control has the highest leverage?
Read the worked answer
Break the chain at the weakest link. The attacker needed three things: control of the number, OTP delivery to that number, and device registration. The bank controls the second and third.
- Telecom status check (highest leverage). Query the operator, or use the available SIM-binding and mobile-number verification services, at onboarding, at device registration and before high-value beneficiary activation. If the number was swapped or ported in the last 48 hours, block and require branch or video verification. This attacks the fraud at the moment of the swap, where it is cheapest to stop.
- Real device binding, not SMS-OTP binding. Bind to a hardware-backed key in the secure element so a new handset requires re-verification with a cooling period. The current SMS-OTP check is defeated by definition once the SIM is swapped.
- Cooling period on new beneficiaries - 30 minutes to 24 hours before a newly added VPA can receive beyond a threshold, with in-app push approval.
- Risk scoring at transaction time: new device plus new beneficiary plus night-time plus amount near limit triggers a step-up call-back.
- Customer education inside the porting flow - a porting request should trigger a bank SMS saying the bank will never ask for an OTP and giving a number to call if the port was not requested.
Why 1 and 2 first: controls 3 and 4 reduce the amount lost per incident; 1 and 2 prevent the account takeover that makes the loss possible at all.
3. Should this be reported as one incident or 27, and what would you tell the customers and the regulator?
Read the worked answer
One campaign, not 27 unrelated disputes - same method, same window, nine beneficiary VPAs. Report it as a single incident with a case count, or the pattern is invisible to the regulator and to the receiving banks.
Reporting lines:
- RBI: report under the cyber incident reporting requirement (2-6 hours of detection) once the pattern is recognised, not after each complaint closes; include aggregate amount, vector (SIM swap), channel affected and containment taken.
- NPCI: raise dispute and liability entries in the UPI dispute management system for each transaction and flag the nine beneficiary VPAs so receiving banks can act - the beneficiary side is where recovery happens. Do this today; the VPAs are still active.
- FIU-IND: if beneficiary accounts show mule characteristics (multiple victims, immediate cash-out), file an STR - this is suspicious-transaction territory, not just a customer dispute.
- Police: advise customers to file complaints and support them with transaction logs; a consolidated complaint helps.
To customers: provisional credit within 10 working days, a named case officer, and a plain explanation that the SIM was swapped. Do not tell a customer they were negligent unless the investigation establishes it - that sentence will be quoted back at the ombudsman hearing.
Root cause to report: device binding was SMS-OTP based and no telecom check existed. That is the finding, not '27 customers were careless'.