Three Frauds at One Jan Seva Kendra Counter
Rajni runs a Jan Seva Kendra in a tier-2 Uttar Pradesh town. On a Monday morning three problems arrive at her counter almost together. (1) A customer, Mohan, says he got an SMS: "Dear customer, your debit card is blocked. Update KYC within 24 hours at this link or your account will be frozen." He tapped the link, typed his 16-digit card number, expiry date and CVV on the page that opened, and then read out to a caller who rang him a minute later the 6-digit OTP he had just received. (2) A second customer wants Rajni to scan a QR code that a person claiming to be a "district officer" sent on WhatsApp, so that a ₹15,000 PM Kisan instalment can be "credited"; the caller says she must enter her UPI PIN after scanning to confirm receipt. (3) Rajni's own computer suddenly shows a full-screen pop-up warning of a virus, with a toll-free number to call and a request to allow remote access. Rajni has twenty minutes before her next appointment.
1. Name the specific fraud pattern in each of the three situations and give the two or three details in each that prove it is a fraud rather than a genuine message.
Read the worked answer
(1) Smishing plus vishing, ending in an OTP fraud. Red flags: (a) a 24-hour threat of account freezing is a manufactured deadline, which no bank uses to force a KYC action; (b) the demand for card number, expiry and CVV on a web page reached from an SMS link - no bank asks for the CVV to unblock a card; (c) the request for the OTP. The OTP is the last lock on the account: genuine bank staff never ask for it, and the fact that a call arrived one minute after the SMS shows the two are one operation.
(2) QR-code 'receive money' scam. Red flags: (a) a UPI QR code is only a payment instruction - scanning one sends money, it never brings money in; (b) the UPI PIN is never needed to receive money; whoever asks for the PIN is taking money out; (c) a government benefit instalment is credited by DBT to the account already seeded in the scheme, never through a WhatsApp QR code from a self-declared 'district officer'.
(3) Tech-support / remote-access scam. Red flags: (a) an unsolicited full-screen pop-up inside a browser, not a system alert from the operating system; (b) a toll-free number displayed inside the pop-up; (c) the request to install a remote-access tool - once installed, the caller can see the screen, capture net-banking passwords and move money.
2. Mohan has already given away his card details and the OTP. What should Rajni tell him to do in the next hour, in order? And what will his liability be under the RBI's limited-liability framework given that he himself disclosed the OTP?
Read the worked answer
Immediate sequence (order matters):
- Call the bank's card-blocking hotline and the national cyber-fraud helpline 1930 at once. Reporting within the golden hour lets the bank freeze the beneficiary account before the money is withdrawn.
- Block the card, then reset net-banking and UPI credentials from a different, clean device. Do not change the password from the same phone if a remote-access app may have been installed.
- File a complaint on cybercrime.gov.in and keep the acknowledgement number; also give a written complaint at the branch and get a stamped receipt.
- Preserve evidence: do not delete the SMS, the call log or the browser history; note transaction IDs, amounts and times.
- Tell him never to call back the number and never to accept a 'refund' link sent by anyone.
Liability: Under the RBI's 2017 customer-protection circular, a customer gets zero liability where the loss is caused by a third-party breach and the bank is informed within 3 working days; between 4 and 7 working days liability is capped (₹5,000 for a Basic Savings Bank Deposit account, ₹10,000 for other savings/current accounts with balance up to ₹25 lakh, ₹25,000 above that); beyond 7 days it is as per the bank's board-approved policy. But the circular also says that where the loss is due to the customer's own negligence - precisely what sharing an OTP is - the customer bears the entire loss. So Mohan should be told honestly that reimbursement is not assured; prompt reporting is still essential because it may allow recovery from the fraudster.
3. What should Rajni do about the pop-up on her own machine? And what should she tell the second customer about scanning the QR code and entering the UPI PIN?
Read the worked answer
The pop-up: treat it as hostile. Rajni should not call the number and never install AnyDesk, TeamViewer or any remote-support tool. She should close the browser with the Task Manager (Ctrl+Shift+Esc) rather than clicking any button inside the window, disconnect the machine from the network if the pop-up returns or the browser reopens by itself, run a full antivirus scan, and check Settings → Apps for anything installed in the last few days. She should also clear the browser's notification permissions and site data, because such pages often re-open themselves through a stored notification permission. Any customer data on that machine should be assumed to be exposed, so she should change her own Kendra login passwords from a different device.
The second customer: explain, without ambiguity, that scanning a QR code only pays out money; it never brings money in, and that the UPI PIN is the authorisation to debit her own account. If she scans and enters the PIN, ₹15,000 will leave her account, not arrive. A genuine government instalment never arrives through a WhatsApp QR code and never needs a PIN. Rajni should advise her to refuse, to screenshot the chat, to block and report the sender on WhatsApp, and to report on 1930 if she has already scanned. Rajni should also record the incident in her centre's register, because a Kendra operator who assists in such a transaction can be treated as part of the fraud chain.