SIM-Swap Fraud, UPI Debits and the Bank’s ‘OTP Authenticated’ Reply
At 10:30 a.m. a customer’s mobile loses network. She visits the telecom store at 11:15 a.m. and is told her SIM has been replaced; a new SIM is issued at 4:10 p.m. Between 12:05 p.m. and 3:40 p.m., seven UPI debits totalling ₹1.47 lakh leave her savings account. Each is authenticated with an OTP and her UPI PIN. The customer says she never shared the PIN or OTPs and did not receive any SMS during the outage. She reports to the bank at 8:20 a.m. the next day and to the cybercrime portal at 10 a.m. The bank’s provisional reply says ‘all transactions were OTP-authenticated, hence customer liability’. Her account balance is ₹2.4 lakh, and the debits went to five different beneficiaries. The bank has not yet frozen the beneficiaries or raised a chargeback. The customer needs money for a hospital deposit and demands immediate credit.
1. Determine who should bear the loss and explain the liability principles. Does OTP authentication alone settle the matter?
Read the worked answer
OTP authentication does not by itself prove that the customer authorised the transactions. The facts point to SIM-swap fraud: the customer lost network, the SIM was replaced, and OTPs went to the fraudster’s SIM. If the customer did not share her PIN or OTPs and reported promptly, the loss is a third-party breach not attributable to her. Under the RBI’s customer-protection framework for unauthorised electronic transactions, prompt reporting within the prescribed period generally gives zero liability where the customer is not at fault. Reporting the next morning is likely to be treated as prompt, but the bank must verify the timeline.
The bank should investigate the SIM replacement, call records, device and IP logs, beneficiary accounts and UPI logs. A blanket ‘OTP authenticated’ response is not a sufficient investigation. If the customer was negligent, such as sharing credentials or delaying reporting unreasonably, limited liability may apply. On the stated facts, the bank should treat the customer as prima facie not liable and process provisional credit within the prescribed timeline, generally 10 working days, while the chargeback and investigation continue.
2. List the immediate actions the bank should take, including beneficiary freezing and chargeback.
Read the worked answer
The bank should acknowledge the complaint in writing, give a complaint reference, block the UPI facility and card if necessary, and preserve all records. It should immediately report the fraud to NPCI/UPI systems, freeze or flag the five beneficiary accounts through the available mechanism, and raise chargebacks within NPCI timelines. It should obtain the SIM-replacement details from the telecom provider, check whether the registered mobile number was changed, and review device-binding and velocity logs. The cybercrime acknowledgement should be placed on file.
The bank should assess provisional credit under the unauthorised-transaction framework and communicate a clear timeline. It should not demand repeated branch visits or ask the customer to ‘prove a negative’ beyond reasonable cooperation. If the bank fails to act, the customer can escalate to the banking ombudsman. Internally, the case should be logged as a fraud incident, root cause analysed, and the customer kept informed. The hospital urgency is relevant to service quality but does not replace the bank’s verification; a provisional credit can address both.
3. What preventive controls would reduce the risk of similar SIM-swap and UPI frauds at the bank and for customers?
Read the worked answer
The bank should use risk-based authentication rather than relying solely on SMS OTP. Controls include device binding, detection of SIM changes, a cooling period or step-up verification after a SIM swap, alerts to registered email and app, velocity limits, beneficiary cooling periods, and checks on unusual IP or device changes. The bank should share SIM-swap intelligence with telecom providers and NPCI, monitor failed OTP attempts, and provide easy in-app reporting and instant blocking. Customer education should cover not sharing the UPI PIN or OTP, protecting the SIM, and reporting loss of network or SIM immediately.
Staff should be trained not to reject complaints with ‘OTP authenticated’ without investigation. The bank should test its chargeback and beneficiary-freezing turnaround, maintain a fraud-incident playbook, and analyse complaints for root causes. Customers should also set transaction limits, use app-based authentication where available, and report suspicious calls or messages. These controls reduce the chance that a telecom compromise becomes an irreversible banking loss.