OTP fraud: the six digits are the payment
An OTP is not a verification code, it is the signature on a transaction. Whoever types it in authorises whatever the message says it is for, and nobody genuine ever needs it from you: your bank, the delivery company, the refund desk and the telecom operator all already have what they need. If someone on a call wants the OTP that has just arrived, the transaction it authorises is theirs, not yours.
How it plays out
The refund that needed an OTP to "confirm"
A courier order she cancelled last week has been refunded, says the caller, except that the refund has failed because her account needs confirming. He has the order number and the amount. He is polite, a little bored, and clearly doing this all day.
An SMS arrives while he talks: a six-digit OTP, from her bank's own sender ID, with a line that says it is for a transaction of ₹49,999 and must not be shared. She reads the number out, because the message always says that and he has already explained that the "transaction" is the refund being pushed through.
He asks for a second OTP; the first timed out, the system is slow today. That one is for ₹49,999 too. The refund, he says, will reflect in two hours. Two debits reflect in two minutes.
The order number was real because the cancellation had been visible to whoever ran the fake shop in the first place. The sender ID was her bank's because the OTP was genuine: it was a real authorisation, for a real payment, that she had been talked into making.
₹99,998 in two card transactions, authorised by two OTPs she read out to a man who was "processing the refund".
A composite of the OTP-sharing pattern as described in RBI customer-awareness notices, bank warnings and Indian police advisories, including the refund-call and double-OTP variants. No real person, bank or case is depicted; the amounts are illustrative.
Where it could have stopped
The OTP message itself. It named the amount and said it was a debit. A refund is money coming in, and money coming in never needs a code from you. The bank's message was telling her what she was authorising; the caller was telling her what to ignore.
High riskWhat EnfoldAI does here
Scam SMS filter
The call is the attack, and the message that sets it up (the fake order confirmation, the "refund failed" SMS, the KYC deadline) arrives first. EnfoldAI flags that message as a scam in the inbox, so the call that follows arrives with its pretext already labelled.
Flags scam and spam SMS automatically.
Auto-check with EnfoldAIHow this scam works
The order is the explanation. Find where your own experience stops in this list. That is how far along the script has run.
- It begins with a reason for a code to arrive: a refund that failed, a delivery to cancel, a KYC update, a credit-card limit increase, a lottery win, a wrong OTP "sent to you by mistake", a job-portal verification. Many of these are set up by an earlier fake message or a fake shop.
- While you are on the call, the scammer starts a real transaction on your card or account, using details taken from a phishing page, a data leak or the order you placed with them. Your bank sends you the OTP for it.
- The caller asks you to read it out "to confirm". The OTP message says what it authorises and says not to share it; the caller's job is to talk over that line, and a second OTP is usually requested with a reason ready.
- The delivery version has no money in sight: a courier calls to say a parcel you did not order is on its way, and to cancel it you must share the OTP that arrives. That OTP is for a payment or a login, not a cancellation.
- SIM swap is the version with no call to you at all. With enough personal detail, a duplicate SIM is issued or an e-SIM is activated, your phone drops to no service, and every OTP now goes to them. Several hours of "no signal" is the only warning.
- A malicious APK (see the fake apps page) does the same job silently, by forwarding every OTP that arrives to the operator.
- The money leaves as card payments, wallet loads or transfers to mule accounts, usually in the maximum amounts the card or account allows, within minutes.
If it has already happened
In order, and the order matters. The first step is the one that can still get the money held, so it comes before everything else.
- Hang up. If an OTP has been shared, the transaction is already in progress; the bank is the only thing that can still stop it.
- Call your bank immediately on the number on your card and report the transaction as unauthorised. Ask for the card to be blocked, further debits frozen, and a dispute raised. Under RBI's customer-liability rules, any loss after you report is the bank's, which is why the call cannot wait.
- Report on 1930 or at cybercrime.gov.in in the same hour, with the transaction reference, the caller's number and the OTP messages.
- If your phone has lost network and you did not request a SIM change, call your operator from another phone and ask whether a duplicate SIM or e-SIM was issued; have it blocked and your number restored.
- Change the passwords and PINs of every account that sends OTPs to that number, from a different device if you can, and check for any app you did not install.
- Keep the OTP messages. They record the time, the amount and the sender, which is the evidence the bank and the police will ask for.
OTP fraud: common questions
The questions people actually ask about this one, answered in a line or two each.
A refund desk asked for my OTP. Can a refund need one?
I shared the OTP myself. Will the bank refund me?
My phone shows no network and money has gone. What happened?
I got an OTP I did not ask for. Should I worry?
Check before you trust
Paste any SMS, link or app and get a verdict before money moves. Auto-scan flags scam messages the moment they arrive.
Suspicious message? Check it free →