The call comes on an ordinary afternoon. The voice is polite, speaks decent Hindi or English, and knows your name. "Sir, I am calling from your bank. Your KYC has expired and your account will be blocked today. I will help you update it — please tell me the OTP you just received."

Everything about the call is designed to feel official. The only official thing about it is the amount that leaves your account two minutes later.

India's digital payment revolution is genuinely historic — UPI now processes more than a thousand crore transactions a month, and crores of families who never had banking now do. But every technology that moves money attracts people who steal it. The fraudsters' methods are not technical. They are psychological. Which means the defence is not technical either — it is knowing the script before you hear it.

The Three Rules That Defeat Almost Every Scam

Before the scam catalogue, learn these. They are short enough to teach your parents in one sitting:

  1. You never need a PIN or OTP to RECEIVE money. UPI PIN is for sending only. Anyone who says "enter your PIN to receive the payment/refund/prize" is stealing from you. There are no exceptions.
  2. No bank, government office, or police officer will ever ask for your OTP, PIN, or CVV on a call. Not for KYC, not to "block a fraudulent transaction", not for verification. The demand itself is the proof of fraud.
  3. Urgency is the weapon. "Your account closes today." "Your son has been arrested." "The offer expires in ten minutes." Legitimate institutions give you time; fraudsters cannot afford to. When you feel rushed, hang up and call the official number yourself.
1930
National cyber fraud helpline — call within the first hour
Source: Ministry of Home Affairs, I4C
3 Days
Report window for zero liability on unauthorised transactions
Source: RBI circular, July 2017
₹5 Lakh
Your deposits insured per bank under DICGC
Source: DICGC, RBI
₹2 Lakh
Free accident insurance on RuPay cards via Jan Dhan
Source: PMJDY, Ministry of Finance

The Scams, Word for Word

The fake customer care number

You search "bank customer care" or "Swiggy refund number" on the internet and call the top result. It's a fraudster's number, planted through ads or edited listings. The "agent" asks you to install a screen-sharing app (AnyDesk, TeamViewer) "to help you", then watches you log into your bank.

Defence: Customer care numbers come from the back of your debit card, your passbook, or the bank's official app — never from a search result. And no genuine support agent needs to see your screen.

The KYC-expiry message

"Dear customer, your account/SIM/wallet will be suspended today. Update KYC: [link]." The link opens a page that looks like your bank and harvests everything you type.

Defence: Banks update KYC in-branch or through their own app. Never through an SMS link. If in doubt, walk into the branch.

"I sent you money by mistake"

A stranger calls: "I accidentally sent ₹5,000 to your number, please return it." Either the original "payment" was fake, or they send a collect request — and when you approve it with your PIN, you are sending money, not receiving it.

Defence: Rule 1. Receiving money never requires your PIN or your approval of a request. Check your actual bank balance — not an SMS, which can be spoofed — before "returning" anything.

Digital arrest

The caller claims to be police, CBI, or customs. A parcel in your name "contains drugs"; your Aadhaar is "linked to money laundering". They keep you on a video call for hours — you are "under digital arrest" — until you transfer money to "settle the case" or "verify your funds".

Defence: There is no such thing as digital arrest in Indian law. Police do not arrest by video call, and no investigating agency settles cases by bank transfer. Disconnect and dial 1930.

The QR code trick

Someone buying your old sofa online says, "I'll pay you — just scan this QR code." Scanning a QR and entering your PIN pays money out. It never brings money in.

Loan apps and investment groups

Instant-loan apps outside official app stores extract your contacts, then harass and blackmail. WhatsApp/Telegram "trading groups" show fake profit screenshots, let you withdraw once, then take everything larger. If returns are guaranteed and pressure is high, it is a scam — legitimate investment carries risk and patience.

The Golden Hour: What to Do the Moment Money Leaves

Speed matters more than anything else, because stolen money moves through mule accounts within hours. Reported fast, it can often be frozen mid-journey.

  1. Call 1930 immediately — the national cyber fraud helpline run by the Indian Cyber Crime Coordination Centre. They can trigger a freeze on the money as it moves.
  2. File at cybercrime.gov.in with screenshots, transaction IDs, and the fraudster's number. Save the acknowledgement number.
  3. Call your bank on its official number and block the card / UPI / account that was compromised.
  4. Keep everything — SMS, call recordings, chat screenshots. This is your evidence for the bank and police.

Your Rights: The Bank Is Not Doing You a Favour

The RBI's July 2017 circular on limited liability is worth knowing by heart:

  • If the fraud happened due to the bank's negligence, your liability is zero — whether you reported it or not.
  • If it was a third-party breach (neither your fault nor the bank's) and you report within 3 working days, your liability is zero.
  • Report within 4-7 working days, and your liability is capped (₹10,000 for basic savings accounts, ₹25,000 for most others).
  • The bank must credit the disputed amount as shadow reversal within 10 working days in eligible cases.

If the bank stalls or rejects unfairly, escalate in writing, wait 30 days, then file with the RBI Ombudsman at cms.rbi.org.in — free, online, and binding on the bank up to ₹20 lakh in awards.

Also know what already protects you passively: DICGC insures your deposits up to ₹5 lakh per bank even if the bank itself fails, and Jan Dhan RuPay cards carry ₹2 lakh accident insurance many families have never claimed.

What You Can Do

  • Teach the three rules to the least tech-comfortable person in your family today. Fraudsters deliberately target elders; one conversation is real protection.
  • Save 1930 in every family phone under "Cyber Fraud Helpline".
  • Delete screen-sharing apps unless you actively need them, and audit app permissions.
  • Never act on financial instructions received on a call you didn't initiate. Hang up, find the official number yourself, call back.
  • If you've been defrauded, report even if the amount feels small or you feel embarrassed. Reports build the case data that gets mule accounts shut down — your ₹2,000 report protects someone else's ₹2 lakh.

The fraudster's entire business model depends on you not knowing these things. Now you do — and knowledge, shared forward, is the cheapest financial security that exists.

Sources