OTP Fraud: How Scammers Steal Your OTP and How to Stay Safe
Learn how OTP scams work and the simple habits that keep your bank money safe.
The one rule
An OTP (One-Time Password) is the final key to your bank, UPI, email or WhatsApp account. No bank, courier, telecom company, government office or police officer will ever ask you to tell them an OTP. Anyone who asks is trying to steal from you – even if they know your name, account number or last transaction.
Common OTP scam scripts
| What they say | What is really happening |
|---|---|
| “Your KYC is expiring, tell the OTP to update it.” | The OTP is for a payment or for adding your account to their phone |
| “I sent you an OTP by mistake, please forward it.” | They are logging into your WhatsApp/Telegram with your number |
| “Courier delivery failed, share the OTP to reschedule.” | OTP for a UPI mandate or account access |
| “Your card has reward points / cashback, give the OTP to credit it.” | Rewards never need an OTP – this authorises a debit |
| “Electricity will be cut tonight, call this number.” | Leads to a screen-sharing app and then OTP theft |
| “Digital arrest” call from fake police/CBI | No agency arrests anyone over video call; they want money or OTPs |
Read the OTP message before anything else
Bank OTP SMS usually say what it is for: “OTP for payment of Rs 49,999 to XYZ” or “to register UPI on a new device”. If you did not start that action yourself, stop. If the SMS says “Do not share with anyone”, believe the SMS, not the caller.
Protect yourself in advance
- Never install AnyDesk, TeamViewer, QuickSupport or any “support” app on a stranger’s request.
- Turn on WhatsApp Two-step verification (Settings → Account) with a 6-digit PIN.
- Use 2-step verification on email, preferably with an authenticator app or passkey.
- Set daily UPI/card limits in your bank app and switch off international/online card use when not needed.
- Keep a separate SIM/number for banking only if you can, and never give your SIM to anyone.
- Call back only on the number printed on your card or the bank’s official website.
एक नियम
OTP (One-Time Password) आपके bank, UPI, email या WhatsApp account की आख़िरी चाबी है। कोई bank, courier, telecom company, सरकारी दफ़्तर या police officer कभी OTP नहीं माँगेगा। जो माँगे वह चोरी की कोशिश कर रहा है – भले उसे आपका नाम, account number या पिछला transaction पता हो।
OTP scam की आम कहानियाँ
| वे क्या कहते हैं | असल में क्या हो रहा है |
|---|---|
| “आपकी KYC expire हो रही है, update के लिए OTP बताइए।” | OTP payment या आपके account को उनके phone में जोड़ने का है |
| “ग़लती से आपको OTP चला गया, forward कर दीजिए।” | वे आपके number से आपका WhatsApp/Telegram login कर रहे हैं |
| “Courier delivery fail हुई, reschedule के लिए OTP दीजिए।” | UPI mandate या account access का OTP |
| “आपके card पर reward points / cashback है, credit के लिए OTP दीजिए।” | Rewards के लिए कभी OTP नहीं लगता – यह debit की मंज़ूरी है |
| “आज रात बिजली कट जाएगी, इस number पर call करें।” | Screen-sharing app और फिर OTP चोरी तक ले जाता है |
| नकली police/CBI की “digital arrest” call | कोई एजेंसी video call पर गिरफ़्तार नहीं करती; उन्हें पैसे या OTP चाहिए |
कुछ भी करने से पहले OTP message पढ़ें
Bank OTP SMS में आम तौर पर लिखा होता है कि यह किसके लिए है: “XYZ को Rs 49,999 के payment का OTP” या “नए device पर UPI register करने का”। अगर वह काम आपने ख़ुद शुरू नहीं किया, तो रुकें। SMS में “किसी के साथ share न करें” लिखा हो, तो caller पर नहीं, SMS पर भरोसा करें।
पहले से ख़ुद को बचाएँ
- किसी अनजान के कहने पर AnyDesk, TeamViewer, QuickSupport या कोई “support” app कभी install न करें।
- WhatsApp में 6 अंकों के PIN के साथ Two-step verification (Settings → Account) चालू करें।
- Email पर 2-step verification लगाएँ, बेहतर हो authenticator app या passkey के साथ।
- Bank app में रोज़ की UPI/card limits सेट करें और ज़रूरत न हो तो international/online card use बंद रखें।
- हो सके तो banking के लिए अलग SIM/number रखें, और अपनी SIM कभी किसी को न दें।
- सिर्फ़ card पर छपे या bank की official website के number पर ही वापस call करें।
Frequently Asked Questions
Does a bank ever ask for an OTP on a call?
No. Banks, RBI, police and government offices never ask you to tell an OTP. Disconnect such calls.
What should I do immediately after an OTP fraud?
Call 1930, block the card/UPI through your bank, and file a complaint on cybercrime.gov.in with all transaction details.
Someone says they sent me an OTP by mistake. Should I forward it?
Never. It is almost always an attempt to log into your WhatsApp or another account using your number.
