Screen-Sharing Fraud on a Retired Teacher's Account
Asha Devi, 63, a retired schoolteacher in Jodhpur, keeps ₹3,10,000 in her savings account. On 6 March at 11:20 a.m. she receives a call from a person claiming to be from the bank's 'KYC department', who says her account will be frozen unless she updates KYC through a link he sends. He persuades her to install a screen-sharing app and read out three OTPs. The UPI logs show three debits of ₹9,800 each at 11:41, 11:43 and 11:46 to three different beneficiary accounts. Her son notices the SMS alerts on 11 March, and she comes to the branch with a written complaint on 12 March. The bank's logs show a new device ID and that the OTPs were delivered to her registered mobile and entered correctly. The money has not been recovered; the beneficiary accounts are in another state. The branch officer says, 'You shared the OTP, madam, so the bank cannot do anything.'
1. Is the officer's statement correct in process and in law? Determine Asha's likely liability and justify it from the facts.
Read the worked answer
The officer is wrong on process, and his legal conclusion is a guess delivered as a verdict.
The RBI's 2017 customer-protection framework for unauthorised electronic transactions applies two separate tests, and both must be worked through:
Timing. Zero liability for a third-party breach where neither the bank nor the customer was at fault, if reported within three working days. Limited liability, capped (₹25,000 for a normal savings account, lower for small/basic accounts), if reported in the four-to-seven working-day window. Beyond that, liability as per the bank's board-approved policy. The debits were on 6 March and the written complaint on 12 March - roughly four to five working days - so she is inside the limited-liability window, not outside it.
Negligence. The cap is not a shield for a customer whose own act is the proximate cause. She installed a remote-access app and read out three OTPs. The logs - new device ID, OTPs delivered to her registered number and entered correctly - show the loss came through her hands. The burden of proving negligence is on the bank, and here it can discharge it.
Realistic outcome: she is not entitled to zero liability. At best she can argue the capped figure; the balance, possibly the whole ₹29,400, may fall on her under the board policy. But that determination is made by the bank's designated committee after investigation, not by a counter officer, and the complaint must be registered, numbered, and resolved within 90 days.
2. List what the branch must do in the first 48 hours, in order of urgency, and explain why the sequence matters.
Read the worked answer
1. Register and acknowledge - same day. Written complaint, acknowledgement number, date-time stamp, and the 90-day resolution commitment in writing. This starts the clock and is her evidence.
2. Stop the bleeding. Block the UPI/mobile-banking channel, deregister the device, force a credential and MPIN reset, block the linked debit card. Until this is done the fraudster can debit again.
3. Call 1930 and file on the cybercrime portal - immediately. The 1930 helpline and the National Cyber Crime Reporting Portal can trigger a lien/freeze on the beneficiary accounts. This is the golden hour: money moves out of the first beneficiary account within minutes to hours, so a report on day one is worth far more than an investigation on day ten.
4. Raise the dispute with the bank's switch/NPCI as unauthorised UPI transactions and ask the beneficiary banks to place a lien, naming the three VPAs and account numbers.
5. Preserve evidence now: device ID, IP logs, OTP delivery logs, the caller's number, the screen-sharing app name, the SMS alerts. Logs have retention limits and are the only proof of what happened.
6. Do not promise recovery and do not tell her to 'come back after the police case'. The bank's own complaint process is independent of the police case.
Why the order: steps 2 and 3 are the only ones that can recover money; steps 1, 4 and 5 are the only ones that can prove the bank behaved correctly. Doing step 6 first loses both.
3. Asha asks how she should bank in future, and the branch's Business Correspondent offers to 'set up the app on madam's phone'. Advise her and rule on the BC's offer.
Read the worked answer
For her - specific rules, not general warnings:
- The bank never asks for an OTP, PIN or CVV, never sends a KYC link, and never asks a customer to install a screen-sharing or remote-access app. Any such call is a fraud call: hang up and dial the branch's known number.
- Keep a small balance in the UPI-linked account and the bulk in a fixed deposit or a second account with no UPI; set a low per-day UPI limit; keep SMS and email alerts switched on and read them.
- Transact only on her own phone, and never hand the phone to a shopkeeper or 'agent' during a transaction.
On the BC's offer - refuse it. A BC is an agent of the bank, not a bank officer. The BC must never ask for or handle a customer's PIN, OTP or Aadhaar OTP, must not install apps on a customer's phone, and must not hold her passbook or card. Transactions at a BC point are authenticated by the customer's own biometric or credentials against the BC's device, and the BC is paid a commission by the bank, not a fee by the customer. If a BC sets up a customer's app and later a fraud occurs, the bank carries the liability for the agent's conduct.
Record the offer in the BC's file, and have the branch give her a short printed do's-and-don'ts card in Hindi - a verbal briefing from the same counter that mishandled her complaint will not be trusted.