Two UPI Debits, One OTP and a 'Recovery Agent'
Kamala, 63, a retired schoolteacher, keeps about ₹1,20,000 in a savings account linked to UPI on her phone. A man calls her, says he is from the bank's 'KYC update team' and warns that her account will be frozen unless she approves a ₹18,000 verification request that appears on her screen. She approves it and ₹18,000 leaves her account. The next day a second caller says he will arrange a refund, sends a link, and asks her to type in the OTP she receives; she does, and ₹45,000 more is debited. Her son takes her to the branch on the fifth day. The officer says, 'You shared the OTP yourself, so the bank has no liability - the money is gone,' and gives her the phone number of a 'recovery agent' who can get it back for a fee.
1. Is the branch officer's statement about liability fully correct? Analyse the two debits separately.
Read the worked answer
Partly right, and dangerously incomplete. Liability in unauthorised electronic transactions is decided by who was at fault and how quickly the customer reported, not by a blanket rule.
Debit 1 - ₹18,000 collect request She approved the request and entered her UPI PIN, so the system recorded a customer-authenticated payment. It is a fraud, but it is not a failure of the bank's systems. Where the loss arises because the customer was induced to approve a payment to an unknown party, the bank is not automatically liable; the outcome depends on the bank's board-approved customer liability policy and on prompt reporting. Because she reported only on day 5, she is outside the short reporting window that protects customers in third-party breach cases.
Debit 2 - ₹45,000 with OTP She voluntarily shared the OTP. Under the RBI's customer-protection framework, where the customer shares payment credentials, the customer bears the loss as per the bank's board-approved policy. Here the officer's conclusion is broadly right, though he should still have registered the complaint and investigated rather than dismissing her.
Where the officer is clearly wrong
- The bank must log a fraud complaint, give a reference number and investigate the beneficiary accounts.
- Handing a senior citizen the number of a 'recovery agent' is unacceptable - recovery agents are a known second scam, and regulated entities are responsible for the conduct of agents acting for them.
2. What should Kamala and her son do in the next 48 hours, and what is the escalation route if the bank does not respond?
Read the worked answer
Immediately (hours matter)
- Call the national cyber-fraud helpline 1930 and file a complaint on cybercrime.gov.in. Early reporting gives the agencies a chance to get the beneficiary bank to freeze the funds. Note the acknowledgement number.
- Email and visit the branch: report both transactions with UTR/reference numbers, ask for the UPI ID to be blocked, the app to be de-registered and the SIM/mobile linked only after re-verification. Keep the written complaint receipt.
- Change the UPI PIN and banking passwords from a clean device, enable SMS and email alerts, and check for any other linked mandates.
- Preserve evidence: call records, SMS alerts, screenshots of the collect request and the link, and a written timeline.
Escalation
- If the branch does not resolve it, write to the bank's nodal officer for customer grievances. Under the RBI's Integrated Ombudsman Scheme, a complaint must first go to the bank; if it is rejected or not answered within 30 days, the customer can file online with the RBI Ombudsman free of cost.
- Do not pay any 'recovery agent'. Do not accept a settlement offer that requires signing away the right to complain.
3. Write four clear prevention rules the branch can give Kamala, in language she will actually remember.
Read the worked answer
Receiving money never needs a PIN. A UPI 'collect request' takes money out of your account. If someone says 'approve this to receive a refund', it is a fraud - reject it. Your UPI PIN is used only when you are sending money.
No genuine bank staff will ever ask for an OTP, PIN, CVV or password. Not on a call, not on WhatsApp, not through a link. If someone asks, the answer is 'no' and the call is disconnected.
Urgency and fear are the tools of the fraudster. 'Your account will be frozen', 'digital arrest', 'KYC will be cancelled today' - all of these are pressure tactics. Hang up, and call back on the number printed on your passbook, card or the official app.
Set limits and watch alerts. Keep the UPI daily limit low, keep SMS/email alerts on, and read the beneficiary name shown on the screen before approving any payment. If a debit happens, report it the same day - every hour improves the chance of recovery.
Add a practical rule for the family: the branch should offer Kamala a short digital-safety session and register her mobile number for alerts to a family member with her consent.