OTP Fraud and a UPI 'Collect' Request at a Repair Shop
Manpreet, 29, runs a small mobile-repair shop in Jalandhar. On Tuesday at 9:40 pm a caller says he is from the bank's KYC cell, that Manpreet's account will be frozen, and that Manpreet must install a 'support' app and read out the six-digit code that will arrive on his phone. Manpreet does both. A minute later his phone shows a debit of ₹18,400 to an unknown account. He panics, does nothing that night and tells nobody. Wednesday is a bank holiday. On Thursday at 11 am he tells his cousin, who takes him to the branch at 12 noon, where he meets the manager for the first time. On Friday a customer buys a screen guard worth ₹1,800, says 'I have sent the money on UPI, just approve the request that has come to your phone', and Manpreet's phone displays a UPI collect request for ₹1,800 with the customer's name.
1. Was Manpreet's report early or late under RBI's rules on customer liability for unauthorised electronic transactions, and how much of the ₹18,400 is the bank likely to bear? Reason both ways.
Read the worked answer
On timing, he is within the window. The debit happened on Tuesday night and he reported it at the branch on Thursday around noon - comfortably inside three working days from the transaction. Under RBI's framework on limiting customer liability in unauthorised electronic banking transactions, a customer who reports within three working days is entitled to zero liability, and the bank is expected to resolve the complaint within a defined timeline, generally crediting the amount within about ten working days where the transaction is a third-party breach.
On conduct, the position is much weaker. The zero-liability protection is built for transactions the customer did not authorise and where the customer did not share the credentials. Manpreet read out an OTP and installed a remote-access app - that is customer negligence, and the framework places loss arising from the customer's own negligence on the customer. The bank will investigate, but it is entirely possible it will decline to reimburse, and it cannot reverse a transfer that has already left the beneficiary's account.
Practical conclusion: treat it as an urgent recovery attempt, not an entitlement. Immediately call the cyber-fraud helpline 1930 and file on cybercrime.gov.in, because a report within the first 24 hours gives the best chance of the beneficiary account being frozen; get a written acknowledgement with a complaint number from the branch; uninstall the app, block the card, change all passwords, and follow up in writing. Do not repeat the claim that 'the OTP means nothing' - argue the facts, keep the acknowledgement, and escalate to the bank's nodal officer if there is no reply.
2. Should Manpreet enter his UPI PIN for the ₹1,800 'request'? Explain what is happening and how he should verify the payment.
Read the worked answer
No. He must not enter the PIN. The phone is showing a UPI collect request - a demand for money from his account, not a payment into it. A UPI PIN authorises a debit; it is never needed to receive money. If he enters the PIN, ₹1,800 leaves his account and the 'customer' walks away with both the screen guard and the cash.
What is really happening: a common shop scam. The fraudster sends a collect request, or shows a screenshot from a fake payment-app image maker, and relies on the trader confusing 'request received' with 'money received'.
How to verify properly:
- Open his own UPI app or the bank's app and look for the credit in the transaction history - not a notification, not a screenshot, and not the customer's phone.
- If there is a credit, check that the amount, the remitter's name and the transaction reference agree.
- Ask for the UTR or transaction ID and match it; fake apps can produce convincing screenshots.
- Decline the collect request in the app. If the request is left pending, it may be approved later by mistake.
- Until the money is actually credited, politely ask for cash or for the customer to try again from his own app.
Rule to memorise for the exam and for life: receiving money never requires a PIN, an OTP or a QR scan; every one of those actions moves money out of your account.