A ₹1.92 Lakh UPI Fraud and a Pending Mobile-Number Change
On 6 August a 63-year-old customer reports that ₹1.92 lakh left his savings account in six UPI transactions on 3 August. He says a caller claiming to be from the bank's technical team told him to read out an OTP to 'reverse a wrong credit'. The branch's records show that on 25 July the customer had submitted a mobile-number change form; the request was still pending with the branch's maker-checker queue because the checker was on leave. Alerts for the six debits therefore went to the old number, which the customer no longer uses. A colleague had also helped the customer install a UPI app at the counter, and the branch's CBS login is shared by three staff, one of whom is on leave. The customer wants a full refund and has posted the story on social media. The bank's board-approved policy provides for partial reimbursement in contributory-negligence cases.
1. Assess the customer's liability. Should the bank refund in full, in part, or not at all?
Read the worked answer
Start from the regulatory framework: liability depends on why the unauthorised transaction happened and when it was reported.
- Where the loss arises from the bank's own negligence or a third-party breach without any fault of the customer, the customer's liability is nil.
- Where the customer himself shared payment credentials, that is customer negligence, and the customer normally bears the loss until he reports the transaction; the bank's share depends on its own conduct and its policy.
Here both sides contributed:
Against the customer: he read out an OTP to an unknown caller. No bank asks for an OTP to 'reverse a credit'. That is the proximate cause of the loss and squarely customer negligence.
Against the bank: a mobile-number change submitted on 25 July was still pending in the maker-checker queue because the checker was on leave. A nine-day delay in a simple service request, with no alternative control such as an intimation letter or a call-back, meant the customer received no alerts on the number he actually uses. There is also a staff-conduct question about who helped him install the app.
So a full refund is not justified, and nil refund is not defensible. The proportionate outcome is partial reimbursement under the board policy, calculated after documenting the bank's contribution and the customer's fault - for example a defined percentage, with the amount approved by the competent authority and not by the branch alone.
2. What immediate and follow-up actions should the branch take?
Read the worked answer
Containment first, then evidence, then communication:
- Freeze the account and disable UPI/card channels so no further debits occur; issue a written confirmation to the customer.
- Trace the funds: obtain the beneficiary VPAs/PSP details, raise a chargeback/dispute through the UPI network, and ask the beneficiary PSP to hold the balance. Speed matters more than paperwork here.
- Get a written dispute from the customer with a timeline, and assist with a complaint to the cyber police; the acknowledgement number belongs in the file.
- Preserve logs: transaction logs, SMS logs, the dated mobile-number change form, maker-checker timestamps and the CCTV of the counter.
- Complete the pending change request now, with identity verification, and check whether the old number is still active with the telecom operator.
- Report internally as a fraud incident and assess whether it is reportable to the regulator under the bank's cyber-incident procedure; cyber incidents have a short reporting window, so do not wait for the inquiry to end.
- Respond to the social-media post through the bank's official channel: acknowledge the complaint, state that it is under investigation, and avoid arguing facts in public or admitting liability.
- Set a service standard - acknowledge and give a decision date in writing.
3. What control changes should the branch and the bank make so this does not recur?
Read the worked answer
The case exposes three separate weaknesses; treat them separately.
Service-request backlog. A mobile-number change is security-sensitive and must have a turnaround standard (typically same-day or 24–48 hours). Build an escalation rule when the checker is absent - a nominated alternate checker, not a queue that waits for someone's leave to end. Review all pending service requests weekly and report ageing to the branch head.
Shared CBS logins. One login used by three staff destroys the audit trail and makes the fraud investigation harder; it also violates the principle of unique user IDs and maker-checker segregation. Each user needs a unique ID, a password known only to them, session logout discipline and periodic access review. This is a disciplinary matter, not just a training point.
Customer awareness and counter conduct. Staff must not install or configure payment apps on a customer's phone at the counter; guide, do not operate. Display and repeat the message that an OTP is never to be shared, with specific attention to senior citizens. When a customer is persuaded to share an OTP, the first alert often goes unseen - so the bank should also send a registered email/SMS on the recorded alternative contact for high-value first-time beneficiaries.
Finally, audit the maker-checker queue monthly and test that alerts actually reach the customer's current contact details.