A Pensioner, a SIM Swap, and an OTP the Bank Trusts Too Much
Gita Devi, 71, a pensioner at your branch, enabled mobile banking five months ago. On 3 Ashadh, at 02:14, three transfers totalling NPR 476,000 left her account for two wallet accounts opened eight days earlier.
The bank's logs show OTPs generated and matched, but the device ID was new - an IMEI never seen on her profile. She says her phone lost network for two days around that date. The telecom operator has confirmed in writing that her SIM was reissued on 1 Ashadh at a store 200 km away, in a district she has never visited, without her presence.
She first complained at the branch on 4 Ashadh. The branch logged the complaint but issued no written acknowledgement. On 12 Ashadh she filed with the bank's grievance cell and threatened to go to NRB. Counter staff say the OTP was authenticated, so the bank bears no liability. A legal notice has now arrived.
1. Who should bear the loss, and what interim steps must the branch take now?
Read the worked answer
Start from the evidence, not from the OTP. The logs prove an OTP was generated and matched; they do not prove the customer received it. A SIM reissued on 1 Ashadh, 200 km away and without her presence, is strong third-party evidence of a swap - and in a swap the fraudster receives the OTP while the genuine phone goes dead, which is exactly what she reported. The staff position that 'the OTP was authenticated, therefore no liability' is unsupportable.
Interim steps this week.
- Freeze mobile banking, re-register only after in-person identification on a new SIM, and ask the wallet issuers to block and lien the two accounts.
- Obtain the telco's call-detail records and the SIM reissue application under legal process, supported by a police complaint.
- Credit NPR 476,000 provisionally within the bank's grievance turnaround time, documented as subject to investigation, so a pensioner is not left without funds for months.
- Issue the written acknowledgement the branch failed to give on 4 Ashadh, with a case number and a named officer.
- Log it as a fraud incident: risk management, IT security and the fraud register, with root cause - single-factor SMS authentication, no device binding, and no velocity or night-time alerts on transfers to new wallets.
Liability view. If the swap is confirmed, the loss sits with the bank. Recovery should be pursued from the wallet holders and the telecom operator, but that is a separate matter from the customer's claim.
2. Set out the escalation path with dates, and address the staff claim that an authenticated OTP ends the matter.
Read the worked answer
The staff claim needs correcting, not punishing. Circulate a short internal note: an OTP is evidence of an authentication event, not proof that the customer authorised the transaction. NRB's IT and customer-protection expectations require the bank to authenticate the channel as well as the person. Add to the remediation list: device fingerprinting, beneficiary cooling-off for newly added wallets, velocity limits and alerts for transfers between midnight and 05:00.
Escalation with dates.
- Day 0: grievance registered; written acknowledgement with case number issued.
- Days 1–3: evidence collection and the provisional credit decision, signed off by the branch manager.
- Day 7: first substantive written reply - what happened, what the bank has done, what is still pending, and the likely date of the final answer.
- Day 30: final reply with the liability determination, remedy and compensation for the delay since 4 Ashadh, which is itself a service failure.
- If unresolved, tell her in writing how to escalate to the bank's grievance committee and to NRB's complaint channel. Do not make her discover the route herself.
The legal notice goes to the legal department the same day; do not reply informally at branch level. Preserve logs, CCTV and all correspondence. Offer a meeting with a senior officer and keep the tone factual.
Why this matters commercially. Most of these cases become litigation over silence rather than over money. A documented, dated trail is the best defence - and the cheapest remedy.