Tricked into sharing a bank code? You may still get money back

A retired teacher in India says she lost Rs 3.73 lakh after a fake card-block text and phone call. Her case shows that handing over a one-time code does not automatically leave you with the whole loss. Under rules from the Reserve Bank of India (RBI), the country's central bank, who pays can depend on how fast you tell the bank.

What happened

In July 2019, the teacher got a text at around 9.40 am warning that her debit card would be blocked. A call followed. She was persuaded to share one-time passwords (OTPs) to register for a so-called 'State Bank Secure App'. Within minutes, Rs 3.73 lakh was taken out through unauthorised transactions.

She reported it to State Bank of India's customer care at 10.31 am, 51 minutes after the first alert. Police later found that four Spice Digital wallets, each registered with a different phone number, were involved. The case is Remadevi T.L. v. State Bank of India.

How the trick works

The scammers used a real banking announcement about blocking non-chip debit cards to look believable. Threats of a blocked card or suspended account push people to act before they check. Criminals do not always need to break into a bank's systems. They can just talk a customer into handing over what unlocks the money.

Who pays under the RBI rules

The RBI framework sorts cases into three groups: bank fault, a breach by a third party, and customer negligence. Each treats losses differently.

• Bank fault: the customer can owe nothing.
• Third-party breach, reported within three working days: the customer can owe nothing.
• Customer negligence, such as sharing credentials: the customer bears the loss until reporting, and the bank bears losses after.
• Third-party breach reported after four to seven working days: limited liability, depending on account type and conditions.

Prasanth Sugathan of the Software Freedom Law Centre says the bank is also liable for any loss after the customer reports the fraud. To blame the customer, it must produce proof of negligence. Sharing an OTP does not automatically defeat a claim, he said, and being tricked by someone posing as the bank is very different from carelessly giving out credentials.

What to do

• Never share your OTP, PIN, password or MPIN, even with someone who says they are from your bank.
• Check any warning through the bank's official app, website or customer-care number.
• Do not use phone numbers or links from a suspicious message.
• Report a fraud right away. Do not wait to work out how it happened.

The reporting time can become key evidence in a dispute. The article text available here cuts off before saying how the teacher's case ended, so the outcome is not known.