Screen-Sharing Scam at a Semi-Urban Branch
At a semi-urban branch, a 64-year-old retired schoolteacher comes in at 4:40 p.m. He says a person claiming to be a bank KYC officer called on WhatsApp, told him his account would be frozen, and persuaded him to install a screen-sharing app. The caller then obtained an OTP. Three UPI debits of ₹16,000 each have reduced his pension account from ₹2.68 lakh to ₹2.20 lakh. He deleted the SMS alerts and still has the app on his phone. He has not filed a police complaint. He demands an immediate refund and says he will go to the local newspaper. The branch manager is on leave; a probationary officer and a clerk are present. The bank's fraud-help line is available, but the branch has no dedicated fraud desk. The customer is agitated and asks staff to 'just reverse it'.
1. List the immediate actions the probationary officer should take in the first hour, in order, and explain why each matters.
Read the worked answer
First hour: keep the customer calm and separate him from other customers. Do not promise reversal. If the phone is still connected to the remote session, switch off mobile data and Wi-Fi immediately; do not factory-reset before capturing screenshots. Note the three UPI reference numbers, beneficiary VPAs, timestamps and amounts. Through the branch or fraud line, hotlist or block UPI, debit card, net banking and mobile banking; reset credentials after preserving evidence; request a cooling period; check whether one beneficiary VPA is still active.
Register the complaint in the bank's fraud/dispute system and give a written acknowledgement with a reference number. Ask him to call 1930 and file a police/cyber complaint. Preserve the app, SMS screenshots, call log and device. Escalate to the fraud monitoring unit the same day; do not wait for the manager.
2. How should the branch explain the customer's liability and complaint route without promising an outcome?
Read the worked answer
Explain that a disputed unauthorised electronic transaction is investigated under the bank's policy and the RBI customer-protection framework. Liability is not decided at the counter and is not automatically zero: it depends on whether the customer shared the OTP or credentials, whether the fraud was due to the bank's systems, and how quickly the bank was informed. Sharing the OTP and installing a screen-sharing app are serious customer-negligence factors, but the bank must still investigate, preserve logs and give a reasoned decision.
Tell him the complaint route: written complaint and reference number, the bank's grievance redressal, 1930 and a police complaint, and the banking ombudsman if the bank does not resolve it within the prescribed time. Avoid saying 'you will get nothing' or 'you will get a full refund'.
3. What prevention measures should the branch adopt for pensioners and staff?
Read the worked answer
For pensioners and first-time digital users, offer lower UPI limits, transaction alerts and assisted registration; display 'never share OTP or screen' posters; train staff to recognise remote-access apps and to act without blaming the customer. Keep a fraud-response checklist at every counter, with the fraud-line number, 1930, dispute form and escalation matrix.
Run digital-literacy camps and SMS/WhatsApp alerts in the local language. Review new beneficiary additions and high-risk UPI transactions. After the incident, record lessons and check whether other accounts have the same beneficiary. The branch should also ensure that the manager's absence does not leave a gap in fraud reporting.