How banking fraud works, and what stops it

Three shapes, endless variations

The stories change constantly. The mechanisms do not.

Get you to reveal a code. OTP, UPI PIN, CVV, card number, net banking password. The pretext varies — KYC expiry, a blocked account, a refund, a prize, an electricity disconnection tonight — and the ask is always the same.

Get you to approve something. A UPI collect request that looks like a payment coming in, an autopay mandate, a screen-share confirmation. You perform the action and the money leaves.

Get you to install something. A remote-access or screen-sharing app, requested for “support”. Once installed, they see your screen and your codes.

All three require your cooperation. That is the encouraging part — the defence is knowledge rather than technology, and it does not depend on the attacker being unsophisticated.

The rules that defeat nearly all of it

Absolute, with no exceptions worth carving out.

1. A UPI PIN is only ever needed to send money. Never to receive it. Any request to enter a PIN in order to get money is fraud, without exception. This single rule stops the most common UPI scam in India.
2. Never share an OTP, PIN, CVV or password with anyone. Bank staff do not ask. Police do not ask. Nobody legitimate asks.
3. Never install an app because someone on a call asked you to. Especially anything offering remote access or screen sharing.
4. Never approve a collect request you did not initiate. Approving one sends money out, whatever the description says.
5. Hang up and call back on a number you found yourself. Caller ID is trivially spoofed. Use the number on your card or the bank's official site — never a number the caller gives you.
6. Reach your bank by typing the address or using the official app. Never through a link in a message, and never via a number from a search advertisement.

Rules five and six matter more than they look. A great deal of fraud begins with a helpline number found through a search result or an advertisement — the number is the scam, and everything after it follows naturally.

The tell is always urgency

Every one of these needs you to act before thinking, because thinking defeats them. So the pretext is nearly always time-critical: the account will be blocked today, the refund expires in ten minutes, the connection will be cut tonight, the KYC deadline is now.

Treat urgency itself as the warning, independent of the story. Genuine institutions send notice, allow time, and do not lose your money because you called back in an hour.

The single most effective habit: when a call or message creates urgency about money, end the interaction and re-initiate it yourself through a channel you found independently. Nothing legitimate is lost by doing this, and it defeats every variant above.

The ones worth recognising by name

• The collect request. A UPI request to pay, described as a refund or a payment arriving. Approving it sends money out.
• KYC expiry. A message that your account will be frozen unless you update KYC through a link. The link harvests credentials.
• The marketplace buyer. Someone “buying” your listed item who insists on sending an advance, then sends a collect request instead.
• Fake customer care. A number found via search or advertisement, often ranking above the real one.
• Screen sharing for support. Any legitimate support process that asks to see your banking screen is not legitimate.
• Investment and job offers requiring an upfront payment or a “refundable” deposit.
• SIM swap. Your number is ported without consent so OTPs go elsewhere. The warning sign is a sudden and unexplained loss of mobile signal — treat that as urgent rather than as a network problem.

Reducing exposure in advance

• Turn on transaction alerts for every account and card, at the lowest threshold available. Speed of detection is what determines recovery.
• Set sensible transaction limits rather than leaving the maximum in place, and lower the limit on cards you rarely use.
• Keep the bulk of your money one step away — in a deposit or a linked account rather than the one attached to your card and UPI. Friction on a small operating balance is cheap insurance.
• Use the bank's own app, keep it updated, and avoid banking on shared or public networks.
• Distinct passwords and two-factor authentication on email above all — email is the recovery route for everything else.
• Check statements monthly. Small test transactions frequently precede large ones.

The first hour matters most

If something has gone wrong, speed is the variable you control, and liability rules in India are tied to how quickly you report.

1. Call the bank immediately and have the account or card blocked.
2. Report through the official cybercrime channel. Fast reporting allows the receiving account to be frozen before the money is moved on, which is the main determinant of whether anything is recovered.
3. File a written complaint with the bank and keep the reference number. A phone call alone is not a record.
4. Preserve everything — messages, numbers, screenshots, transaction references.
5. Change credentials for banking and for the email attached to it.
6. Escalate if unresolved — the bank's grievance process first, then the banking ombudsman.

The RBI operates a limited-liability framework for unauthorised electronic transactions, under which a customer's liability depends substantially on how quickly the incident was reported. The reporting windows and the exact liability position are set by regulation and have been revised — verify the current rules rather than relying on any summary, and report immediately regardless.

Why the buffer matters here too

The structural defence is the same one that helps everywhere else: do not keep more than an operating balance in the account attached to your card and UPI.

Money held one step away — in a deposit, a sweep account, or a fund taking a day to redeem — is money a single compromised credential cannot reach. That day of friction costs almost nothing in return and removes most of the downside.

FNOTrader is not a bank and does not hold customer funds. This describes how the frauds work; the reporting rules are set by the RBI and your bank.

Common questions

Continue reading

More in Banking · App: Mutual Funds · Definitions: glossary · Free tools: calculators · All: every article