The OTP Call at the Cyber Desk
At 11:20 a.m., a 63-year-old retired teacher comes to the cyber desk. He says a man claiming to be his bank's 'KYC manager' called from a mobile number, told him his account would be frozen, and asked him to read out an OTP. He did so. Two SMS messages show debits of ₹28,000 and ₹20,000 to unfamiliar UPI IDs. He has brought his passbook, Aadhaar card, the phone, and a screenshot of the call log. He is trembling and says, 'Just cancel the number and the money will come back.' The bank branch is 2 km away; the cyber cell has one desktop with internet. He has not called the bank or 1930 yet. The phone battery is at 8%.
1. What immediate steps should you take, and in what order?
Read the worked answer
Treat the first hour as a race: the fraudster will try to move the money through mule accounts.
(1) Do not factory-reset or switch off the phone; preserve SMS, call log, UPI IDs and screenshots. (2) Call the bank's fraud helpline and the national cyber helpline 1930; ask the bank to freeze the account, block UPI/card and flag the two transactions. (3) File a complaint at cybercrime.gov.in and give a written complaint at the police station with transaction IDs/UTR, timestamps, caller number and the OTP SMS. (4) Charge the phone, but do not install any 'remote support' app suggested by the caller. (5) Give the victim a written acknowledgement and the complaint number; do not promise recovery.
Order matters: bank freeze and 1930 first, because every minute increases the chance the money is layered away; detailed paperwork can follow. The judgment is to preserve the electronic trail while stopping further loss.
2. What evidence should you record, and why does each item matter?
Read the worked answer
Record: the two debit SMS with amount, time, UPI ID/UTR; the caller's number and call duration; the OTP SMS; the victim's bank account and customer ID; device make/model and IMEI if available; screenshot of the call log; and the victim's statement in his own words.
Preserve the phone as evidence only if necessary; if seized, prepare a seizure memo with two witnesses and give a receipt, because the phone contains the original electronic record. Under the BSA, electronic records need careful handling - do not edit or delete messages; take screenshots with date/time visible and, if possible, export the SMS. Also collect the bank statement after the freeze.
Explain why each item matters: UPI ID and UTR let the bank and cyber cell trace the beneficiary; timestamps establish the sequence; the OTP SMS shows the modus operandi; the caller number links to other complaints. Without this record, the bank may reject the chargeback and the court may not accept the electronic evidence.
3. How would you explain the situation to the victim, correct his misunderstanding, and advise him on prevention?
Read the worked answer
Tell him plainly: cancelling the SIM will not reverse a UPI transfer. The money has moved to another account; recovery depends on the bank freeze and tracing, not on the number.
Do not blame him - shame stops victims from reporting. Explain the standard rules: never share an OTP, CVV, PIN or screen; a bank never asks for KYC on a phone call; verify the caller by calling the branch's official number; do not install remote-access apps; check SMS alerts. Advise him to change passwords, enable transaction alerts and inform his family.
Give him a copy of the complaint and the 1930 reference. If he is elderly and alone, involve a family member or a local community volunteer with his consent, respecting his privacy. The reasoning is that recovery is more likely when the victim cooperates, and prevention advice reduces repeat victimisation.