The KYC Email, the OTP Call and Twelve Aadhaar Copies

Warning signs

1. A threat with a deadline. 'Within 24 hours or your account will be frozen' is designed to stop him thinking. Real banks do not freeze accounts by email.
2. A request for PIN and OTP. No bank, and no genuine refund process, ever needs an ATM PIN or an OTP. The OTP is the second lock on his own account; giving it away is the same as handing over the key.
3. A link in an email. The link almost certainly goes to a look-alike page that copies whatever he types, including the OTP.
4. Spoofed caller ID and a channel switch. The number shown can be faked, and moving from email to WhatsApp to a phone call is a classic way to keep him talking and away from a second opinion.
5. A refund that requires him to act on his account. Money coming in never needs his PIN. The Rs 15,000 is bait.

Next ten minutes

• Do not click the link, do not open the attachment, do not share the OTP; end the call.
• Log in separately through the bank's own app or by typing the bank's address, and check the account; alternatively call the number printed on his card or passbook.
• If the OTP was already spoken, call the bank's fraud helpline immediately and ask for the card and net banking to be blocked.
• Report the number and email on the national cybercrime helpline 1930 or cybercrime.gov.in, and tell the two or three shopkeepers nearby, because the same list is being worked down the street.

The explanation to give him 'Ramesh bhai, those twelve photocopies are twelve people's identities. With an Aadhaar number and a PAN, someone can open a bank account, take a small loan or get a SIM in that person's name. The customer will never suspect you - but the fraud will trace back to the shop where the copies were kept, because that is where they were last seen. Under the Aadhaar law and the data protection law, keeping someone's Aadhaar without their consent and without securing it is the shop's responsibility, not the customer's. If a copy leaks you lose the trust of the whole locality, and a shop that handles forms lives entirely on trust.'

The routine

• Take only the documents actually needed for that form, and note them in a simple register: name, document, date given, date returned.
• Return or shred the copies the same day; if a copy must be kept, keep it in a locked drawer or cupboard, not on the counter.
• Never send Aadhaar or PAN images over ordinary WhatsApp to a stranger; use the official portal upload if the work requires it.
• Take a one-line consent: 'I give a copy of my Aadhaar for this form, to be returned on ...'.
• Cover the counter position so documents are not visible to the next customer standing at the shop.

Recommendation: yes, but in the right order. Rs 4,000 a year is about Rs 333 a month - roughly the margin on a few dozen photocopies. Against that, one ransomware infection or one dead hard disk means the shop stops for days, loses the pending forms of customers, and loses the goodwill that took years to build. The antivirus alone is cheap insurance; the cloud backup is the part that actually saves the business, because it lets him work from another machine after a failure.

What to do first, free of cost

1. Change 'ramesh123' to different, long passwords for the email, the bank portal and the form website, and switch on two-step verification on the email - that account is the master key for everything else, including password resets.
2. Remove the pen drive from the cash drawer and keep a second copy somewhere else; a backup stored next to the original is lost with the original in a theft or a fire.

Then spend Buy the antivirus and a cloud backup plan, set the backup to run automatically, and check once a month that a file can actually be restored. Keep one offline copy as well, because some ransomware encrypts any drive it can reach, including a connected cloud folder.

The point to stress to him: the software is the smaller half. Weak passwords and unguarded customer documents create more loss than a missing antivirus.