How an OTP fraud is actually built
An OTP fraud is not a technical attack. It is a three-stage social one, and each stage has a job. The first stage is the pretext: a reason for the call or message that sounds administrative and boring rather than alarming. Your card is due for renewal. Your account will be credited with a refund. Your reward points expire tonight. Boring is deliberate, because a dramatic story invites scrutiny and a dull one does not.
The second stage is manufactured credibility. The caller opens with something they already know — your full name, the last four digits of your card, the branch you bank with, sometimes a recent merchant you paid. None of this is secret. It leaks from breached merchant databases, delivery labels, loan enquiry forms and social media. But hearing a stranger recite it produces a powerful and false conclusion: only my bank could know this. In reality, knowing your name and card suffix proves nothing at all, because those are precisely the details that leak most often.
The third stage is time pressure, and it is the one that actually does the damage. You are told the window is closing — the card will be blocked in ten minutes, the refund lapses at midnight, the offer ends with this call. Compressed time suppresses deliberation. You stop asking whether the story makes sense and start trying to finish the task. That is the exact moment the six digits are requested, and the only thing the fraudster ever needed. They do not have your password. They do not need it. Your OTP completes a transaction they have already set up and are waiting on.
The rule that survives every variation: an OTP is not a verification of your identity to a bank. It is your authorisation of a transaction. If you did not start a transaction in the last sixty seconds, there is nothing legitimate for an OTP to authorise. Read the SMS itself — it names the amount and the merchant. If you did not intend that amount, the call is a fraud, no matter who the caller claims to be.
Phishing vectors: the four doors they knock on
The first door is SMS. A message arrives warning that your KYC has expired, your account is suspended, or your electricity connection will be cut tonight, with a shortened link. The link opens a page that looks like your bank, sometimes pixel-accurate, and asks you to log in. The tell is always the address bar, never the design. Look at the domain immediately before the first single slash: a real bank domain is short and ends in a way you recognise, while a phishing domain buries the bank's name in a subdomain or a hyphenated string. Banks do not conduct KYC through links sent by SMS.
The second door is voice, and it is the most effective, because a human voice adapts to your hesitation in real time. Caller ID means nothing — spoofing a number is trivial and free. The dangerous escalation is when the caller asks you to install an application so they can 'help' you. Any screen-sharing or remote-support app hands over your live screen, and on many phones your incoming SMS, which means every OTP you receive from that moment. No bank employee will ever ask you to install anything during a call.
The third door is search. Fraudsters buy advertisements and seed business listings so that a fake customer-care number ranks above the real one. You call it yourself, which removes all your natural suspicion, because you initiated contact. The fourth door is the app store: applications that clone a bank's name and icon closely enough to pass a quick glance. Take helpline numbers from the back of your debit card, your passbook, or the bank's own app — never from a search result — and install banking apps only by following a link from the bank's official website.
One habit closes all four doors: never continue on the channel that contacted you. If a message, call or search result raises a concern, stop, and re-establish contact yourself through a number or app you already had. A genuine issue will still be there when you call back. A fraud will not survive the switch.
The UPI collect-request trap
UPI has one rule that is worth understanding completely, because nearly every UPI fraud depends on people not knowing it. Your UPI PIN authorises money leaving your account. It is never required for money entering it. Receiving is passive: if someone sends you money, it simply arrives, with no action from you at all. So any instruction that involves entering your PIN 'to receive' something is, without exception, an instruction to pay.
The mechanism abused was the collect request — a feature that let someone ask you to pay. It appears as a notification with an amount and a note, and the note is attacker-controlled text, so it can read 'Refund for cancelled order' or 'Prize credit' while actually being a debit request. Approving it and entering your PIN sends the money out. NPCI switched off person-to-person collect requests on 1 October 2025, which removed the commonest version of this trap, but merchant payment requests, payment links and fake merchant handles still exist, and fraudsters have moved to them. The typical settings are unchanged: marketplace sales, where a 'buyer' asks you to approve something to receive payment for the item you listed, and refund scams after a fake order cancellation.
Scanning a QR code works the same way. A QR code encodes a destination for payment. It cannot pull money toward you. If anyone asks you to scan a code, or to enter a PIN after scanning, in order to receive a payment, the transaction is running in the opposite direction to the one you have been told. Read the confirmation screen before authorising: it always states plainly whether you are paying or being paid, and it is the last honest thing you will see.
Memorise this and you are immune to the entire category: no PIN is ever needed to receive money. Not on UPI, not on any Indian payment app, not once.
Building a verification loop you actually follow
Under pressure, intentions fail and habits hold. A verification loop is a short fixed sequence you run every time you pay someone new, so that you are not relying on being alert on the day it matters. Four checks are enough. Confirm the IFSC resolves to the branch your payee named. Confirm the account number character by character from a source your payee sent you directly, not from a forwarded message. Confirm the beneficiary name your banking app displays after you add the payee. And confirm the amount by reading it aloud before you authorise.
The third check carries most of the weight and is skipped most often. When you add a beneficiary, your bank fetches and displays the name registered on that account. If it does not match the person you believe you are paying, stop, whatever the explanation offered. 'That is my brother's account', 'the company account is in the accountant's name', 'the name will update later' — these are the sentences that appear in almost every account-takeover and impersonation complaint. A mismatch is not a formality. It is the system telling you that the money is going somewhere other than where you think.
For a first payment of significant size, send a small test amount, then confirm receipt by voice with the payee on a number you already had — not one supplied in the same conversation that requested the payment. Keep a screenshot of the confirmation with its reference number. If something later goes wrong, that reference is what turns a vague complaint into a traceable one, and speed of tracing is what determines whether funds can still be frozen.
The loop only works if it is unconditional. The moment you allow yourself to skip it because the request is urgent, you have handed the decision to whoever created the urgency — and urgency is manufactured far more often than it is real.
If it has already happened: the first twenty-four hours
Speed decides whether money comes back, because a fraudster moves stolen funds through several accounts within hours. On the same day, call the National Cyber Crime Helpline on 1930, file the complaint at cybercrime.gov.in and tell your bank in writing, keeping every reference number. Our step-by-step guide to the first 24 hours covers what to do in what order, what the RBI's liability rules mean for your money, and how to escalate if your bank does not help.
Report on the same day, even if you are unsure. Withdrawing a complaint later is trivial. Recovering money that has already been layered through three accounts is often impossible.