The Caller Who Said He Was From the RBI
At 11:40 a.m. on a Tuesday, while posted in the corridor of a Reserve Bank of India regional office, guard Ramesh overhears Sanjay, a contractual housekeeping worker, reading out a six-digit number on his mobile and saying, 'Yes, the app is installed.' Sanjay explains that the caller is from the 'RBI verification department' and is processing a pending refund of ₹4,850 linked to his salary account. The caller has told him to keep the matter confidential and not to inform the desk officer. On the phone screen the number appears as an ordinary ten-digit mobile number. The 'notice' the caller sent is a WhatsApp image carrying an RBI-style logo, but it has no reference number, no date and no signature. Sanjay has already been asked for a photograph of his Aadhaar card and is about to send it. He asks Ramesh whether he should do so, since 'a government office will not cheat'.
1. Identify three features in this situation that indicate the contact is fraudulent, and explain why each feature matters rather than merely naming it.
Read the worked answer
The channel and the number. A genuine RBI communication about a personal refund does not arrive as a WhatsApp image from a ten-digit mobile number. Regulated official correspondence carries a reference number and comes through documented channels. The absence of a reference number, date and signature means the document cannot be traced to any issuing office, which is exactly what a forger cannot supply.
The demand for an OTP and an Aadhaar photograph. A six-digit number read out on a call is an authentication code. No genuine institution needs it; it exists to prove the caller is the account holder, so anyone asking for it is trying to become the account holder. An Aadhaar image compounds the risk because it can be reused for identity theft long after this one transaction.
The insistence on secrecy. A real office has no reason to stop an employee from consulting a supervisor. Secrecy is engineered to isolate the victim before a relative or officer can intervene, and it is the strongest single signal that the 'process' would collapse under scrutiny.
2. What should Ramesh do in the next ten minutes, and in what order? Justify the sequence.
Read the worked answer
Order matters because the money can move in minutes.
Stop the transfer of information first. Ask Sanjay not to send the Aadhaar photograph and not to share any further code. This is first because it is the only step that is irreversible if delayed; everything else can be done afterwards.
Escalate, do not investigate. Inform the shift supervisor or desk officer immediately and record the time. A guard's duty is to secure and report; verifying a fraud is not his role, and his own enquiry could destroy evidence or warn the caller.
Preserve evidence. Note the caller's number, keep the WhatsApp image and the call log, and do not delete anything.
Guide the victim to the proper remedy. Advise Sanjay to inform his bank at once to block the account or card, and to report on the national cyber-fraud helpline 1930 or the cybercrime portal, quoting the number and the timeline.
Write a brief entry in the duty register. A contemporaneous record protects both Sanjay and the guard if questions are asked later.
3. Sanjay argues that the caller must be genuine because the notice shows the RBI logo. How should Ramesh answer him, and what general rule should he give him for the future?
Read the worked answer
Ramesh should separate the appearance of authority from the proof of it. A logo is an image file that anyone can copy from a public website in seconds; it certifies nothing. What a genuine communication has, and a copy does not, is a traceable identity: an issuing office, a reference number, a date, a signature or an official domain in the sender's address.
The general rule to give him: verify through a channel you chose, not one the caller supplied. Walk to the office or call the number printed on the bank's own website or passbook, never the number in the message. Add two supporting rules: no genuine institution asks for an OTP, PIN or Aadhaar copy to release money, and any instruction to keep a transaction secret from supervisors or family should be treated as fraud until proven otherwise. Ramesh should also add that being a government office is precisely why the RBI does not run refunds through mobile calls, so the claim of official status is a reason for doubt, not comfort. Finally, he should remind Sanjay that reporting a suspected fraud costs nothing, while a delayed report can cost the entire amount.