Three Messages, One Credential: A Student's Fraud Judgement Call
Simran, a Class 10 student in Bathinda, uses her father's Android phone for her NSQF IT work. On 12 August she receives in one hour: (i) an SMS from sender ID 'SBI-KYC' saying her debit card is blocked and KYC must be updated at a shortened link by entering card number, expiry, CVV and the OTP sent to the phone; (ii) a UPI app notification, 'Collect request of ₹1,999 from FLIPKART-REFUND - approve to receive money'; (iii) a WhatsApp call from a man claiming to be a delivery agent who needs the 6-digit code 'to confirm her COD order'. She opened the SMS link in the phone browser and typed the card number, then stopped because the page asked for the CVV. In June she had given an OTP to a caller and ₹600 left the account. Her friend suggests finishing the KYC at a nearby cyber café for ₹50, on the café's computer. Her father's account linked to that card holds ₹43,000; her own Jan Dhan account holds ₹1,240.
1. Name the technique behind each of the three contacts, state the single factor they all share that makes them fraudulent, and identify precisely which action would have turned this into an irreversible loss.
Read the worked answer
(i) Smishing / phishing by link. A bank never sends a KYC link that asks for full card data. Card number plus expiry plus CVV plus OTP is enough for a card-not-present transaction - the fraudster needs no physical card.
(ii) UPI collect request. This is a pull mandate: approving it debits ₹1,999 from her account. A genuine refund is credited by the merchant and never requires the customer to approve a collect request or enter a PIN to 'receive' money. The word 'REFUND' is the bait.
(iii) Vishing. A caller who needs the OTP is not confirming an order - the OTP is the bank's authorisation, and it authorises whoever types it.
The shared factor. All three are asking for a secret that the legitimate system already knows and will never request back: card credentials, a UPI approval, or an OTP. The channel (SMS, app notification, voice call) is irrelevant; the request for a secret is the signal.
The irreversible step. Entering the OTP - not the card number, not the CVV, not clicking the link. The OTP is the bank's proof that the account holder authorised the debit. Once submitted, money leaves the account; the customer can only dispute and request a reversal, not undo it. Clicking the link alone leaks nothing until she types a secret into it, which is why stopping at the CVV was the correct call even though the page was already open.
2. Write the action plan for the next 60 minutes, listing the evidence to preserve, and explain why the cyber café plan must be rejected even though it is cheap and nearby.
Read the worked answer
Next 60 minutes, in order.
- Close the browser tab; enter nothing further. Do not delete the SMS or the chat.
- Reject or let the collect request expire - never tap Approve. If it was already approved, that is an unauthorised debit and must be reported immediately.
- Ring the bank's number printed on the card (never a number from the SMS, which may lead to the fraudster's 'helpdesk'), ask for the card to be blocked and reissued, and reset the UPI PIN and app password from the bank app.
- Report on the national cybercrime helpline 1930 and at cybercrime.gov.in. Speed matters because banks can freeze the beneficiary account if the report is quick; the RBI customer-protection framework gives the best outcome for third-party fraud reported within three working days, and weaker protection as the delay grows.
- Reopen the June incident: ₹600 gone after an OTP call is an unauthorised transaction that should also be reported; she should not accept it as a lesson learnt.
Evidence to keep. Screenshots with the timestamp visible, the sender ID, the shortened URL, the collect request VPA and reference number, and the June statement entry. Do not forward the link to friends to 'check'.
Why not the cyber café. She would type card details plus an OTP into a machine she does not control, where a keylogger, a remote-access tool or a saved browser session can capture everything, with no accountability and no receipt. KYC is done in the bank branch or the bank's own app only; a ₹50 shortcut to a blocked card is the same fraud with an extra step.
3. Assume she did tap Approve on the ₹1,999 request and then switched the phone off. Describe what the bank's records will show, who generally carries the loss under India's customer-protection rules for unauthorised electronic transactions, and the first three things she must do.
Read the worked answer
What the bank sees. A UPI debit authorised by her own UPI PIN or by the app's approval flow, to a VPA, at a timestamp. From the bank's side it looks like a normal customer-authorised transfer, because the collect request was approved on her registered device. That is why 'I did not do it' is not enough - the burden shifts to showing it was induced by fraud and reported promptly.
Who bears the loss. Under the RBI's framework for unauthorised electronic transactions, liability depends on the type of breach and the reporting delay: where the fraud is due to a third-party breach and the customer reports within three working days, customer liability is generally zero; report after that and liability is limited but shared, and it worsens with further delay. Where the loss is attributed to the customer's own negligence in sharing credentials, the customer can bear the whole amount. The exact split is per the bank's policy, so she should ask for the complaint reference number in writing.
First three actions. 1) Call the bank, report an unauthorised UPI debit, get the complaint/acknowledgement number. 2) File on 1930 / cybercrime.gov.in the same day, quoting that number and the VPA. 3) Change the UPI PIN and app password from a clean device, check for other linked mandates, and tell her father so the card can be watched. Do all three today - the clock on liability started when the debit happened, not when she decided to report.