The Mirrored Screen: A Rs 1.85 Lakh UPI Fraud Reported 38 Hours Late
A 62-year-old retired schoolteacher walks into a police station in Amritsar at 11:00. Between 21:12 and 21:23 the previous night, Rs 1,85,000 left her savings account in four UPI transfers of Rs 40,000, Rs 50,000, Rs 45,000 and Rs 50,000, all to different UPI IDs that look like merchant handles. At 20:55 she had received a call from a number showing a bank's name on the caller-ID app; the caller said her KYC would lapse and sent an SMS link. She installed an app from the link, shared a code, and her phone screen was mirrored to the caller for about twelve minutes. Her phone still has the app installed and is at 8% battery. She has the four debit SMS alerts, no screenshot of the app, and has already been told by her bank branch to 'come back after two days'. She is the primary account holder and her pension is credited to the same account. The station has one computer with internet access and one constable trained in cyber complaints.
1. Set out the first actions you would take, in order, and explain why the sequence matters.
Read the worked answer
- Treat the first hours as evidence time. Money moved by UPI normally rests briefly in the beneficiary or merchant account before a second hop. Speed is the entire case.
- Call 1930 and file on cybercrime.gov.in. The complaint feeds the Citizen Financial Cyber Fraud Reporting and Management System, through which a request can go to the bank and NPCI to place a lien on the beneficiary account.
- Call the bank's fraud line with the four UTR/RRN numbers, ask for the beneficiary accounts to be flagged and frozen, and ask for UPI and card blocking on her account - done from a different, safe device, not from the compromised phone.
- Register her complaint at the police station. The bank branch is not the forum that stops a transaction. Note the 38-hour delay on the record, but do not use it as a reason to refuse.
- Explain liability honestly: under the RBI's limited-liability framework for unauthorised electronic transactions, a customer who reports within three working days bears zero liability; delay affects who bears the loss, not her right to complain.
- Do not send her home to 'come back tomorrow'. If the trained constable is off duty, take the complaint yourself and enter it on the portal.
2. What must be preserved on the phone, and what must the victim be told not to do?
Read the worked answer
Tell her immediately: do not uninstall the screen-sharing app and do not factory-reset the phone. Both destroy the permissions log that shows exactly what the fraudster could see.
Preserve:
- Photographs of the screen - the app, the call-log entry at 20:55, the four SMS alerts with timestamps, and the beneficiary UPI IDs.
- Make, model and IMEI, with the battery level recorded at the time of seizure.
- The SMS containing the link; do not 'clean up' the message box.
- Six months of bank statements, with the UTR/RRN, beneficiary VPA and merchant name for each of the four entries.
- A check of whether the app was given Accessibility and Notification access - that is how OTPs and screen contents are harvested.
Handle the device lawfully: extraction or cloning must follow the prescribed digital-evidence procedure, and the electronic record needs the certificate under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, with a hash value.
Also check for collateral damage: other financial apps on the phone, saved cards, and whether the same OTP was used to change her UPI PIN.
3. What five points would you put across at the next community awareness meeting so that this specific script fails next time?
Read the worked answer
Keep it short, concrete and in Punjabi, with the phone in hand as a prop:
- Your bank never sends a link and never asks you to install an app. 'KYC will lapse', 'your SIM will be blocked', 'your electricity connection will be cut tonight' - these are scripts, not notices.
- No remote-access or screen-sharing app on a bank call. AnyDesk, TeamViewer, QuickSupport and screen-mirroring apps let a stranger read your OTP as it arrives.
- Never read out an OTP. The message itself names the purpose; if it is for a transaction you did not start, it is fraud in progress.
- Report in the golden hour on 1930. A late report is still worth making, but an early one can freeze the money before it moves again.
- Ask for help from a family member before clicking, not after. The victims are usually the account holders least familiar with the interface.
Deliver it at the grain market, the school and the gurdwara, and paste the 1930 number on the police station notice board. A prevention session that reaches twenty smartphone-owning pensioners is worth more than one more case file.