OTP fraud in India 2026: SIM porting, OTP interception, fake KYC calls, the 1930 helpline, and the customer losses the RBI will compensate from 2027.
Yes, OTP fraud remains the most common route into an Indian bank account, because the one-time password is a bearer secret delivered to a channel the attacker can reach. The four techniques are SIM porting, interception that now includes AI voice cloning during a bank call, OTP relay through a fake agent who asks the customer to read the code aloud, and fraudulent KYC using a forged document and a cloned voice. RBI's June 2026 instructions, effective 1 January 2027, will allow compensation for victims who report within 5 calendar days.
Four methods, in ascending order of technical effort. SIM porting, where the attacker persuades the telecom operator to move the number to their own device, and which needs only a little social engineering plus identity documents. Interception, which historically needed malware and now includes AI voice cloning, so an attacker can call a bank, hold a conversation in the customer's voice, and pass the verification that a bank agent will ask for. OTP relay, where a fraudster posing as a bank or platform agent persuades the customer to read the code aloud, which is still effective because the call has started on a number the customer dialled. And fraudulent KYC, in which a forged document and a cloned voice pass the verification, which is why the I4C warned in June 2026 about deepfakes defeating facial authentication and video-based KYC. What all four share is a reliance on the customer to be the weakest link, which is why banks have changed their scripts.
RBI's June 2026 instructions, effective 1 January 2027, allow compensation of 85% of net loss or Rs 25,000, whichever is less, for a genuine individual victim whose gross loss is up to Rs 50,000, provided the customer reports to the bank and to the National Cyber Crime Reporting Portal or the 1930 helpline within 5 calendar days. That 5-day window is the operative detail, because a customer who waits a week to see whether the bank reverses the transaction has lost the entitlement. The scale of the underlying problem is what prompted it: Indians have lost over Rs 22,800 crore to telecom fraud and impersonation scams, and 21,900 digital-arrest complaints involving over Rs 647 crore were registered in the first eight months of 2026 alone.
Move away from the one-time password as the sole factor for the highest-risk actions, and add device binding, which ties the OTP request to a specific app installation, a specific device and a specific session. Make the OTP request context-aware, so a code is only valid for a transaction the customer initiated in that session. Never accept an OTP read aloud, and treat a code request that follows a customer-initiated call as suspicious. Add a cooling-off and an out-of-band callback for new beneficiaries and new device enrolments, and make a new device enrolment a hard stop rather than a soft warning. And instrument it: an OTP request from a new device, a new SIM, or a new location should raise an alert to a human, not just a step-up prompt.
Five steps, in order. Call your bank's 24-hour fraud number, not the number in the SMS, and ask for the account to be flagged and the transactions under dispute. Report on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the 1930 helpline, because a freeze depends on speed. File on the Money Restoration Portal and keep the acknowledgement, because the 5-calendar-day reporting condition in RBI's June 2026 instructions applies from 1 January 2027. Report the SIM port or the number transfer to your telecom provider. And preserve evidence, including the SMS, the call details and any payment reference, because the forensic trail in a digital-arrest case runs on timestamps.
| Method | What the attacker does | Control that breaks it |
|---|---|---|
| SIM porting | Moves the number to an attacker device | Number-transfer lock at the operator |
| Voice-cloned bank call | Impersonates the customer to the bank | Out-of-band callback on a known number |
| OTP relay | Asks the customer to read the code aloud | Bank scripts that refuse to accept spoken codes |
| Fraudulent KYC | Forged document plus cloned voice | Liveness plus device-bound verification |
| Collect request | Triggers a UPI collect prompt | A UPI PIN authorises payment, it does not receive money |
Yes, OTP fraud remains the most common route into an Indian bank account, because the one-time password is a bearer secret delivered to a channel the attacker can reach. The four techniques are SIM porting, interception that now includes AI voice cloning during a bank call, OTP relay through a fake agent who asks the customer to read the code aloud, and fraudulent KYC using a forged document and a cloned voice. RBI's June 2026 instructions, effective 1 January 2027, will allow compensation for victims who report within 5 calendar days.
Under RBI's June 2026 instructions, effective 1 January 2027, a genuine individual victim with gross loss up to Rs 50,000 can be compensated at 85% of net loss or Rs 25,000, whichever is lower, provided the loss is reported to the bank and to the National Cyber Crime Reporting Portal or the 1930 helpline within 5 calendar days.
No bank or platform should ever need you to read an OTP aloud, and a call that asks you to do so is a fraud call. Terminate the call, call your bank's number from your card or statement, and report it on cybercrime.gov.in or the 1930 helpline. Legitimate agents do not ask for the code, the PIN, the CVV or the full card number.
It is a fraudster who poses as a bank or platform agent, gets the customer to approve the transaction on their app, and then asks them to read the OTP or the UPI PIN back. It works because the customer believes they are on a legitimate call, which is why the callback rule matters more than any app control.
As a recovery method, yes, because a customer who has lost their phone still needs a way in. As a primary method, no. Device binding, an authenticator app or a passkey removes the interception problem entirely, and it is what banks and fintechs should be steering customers towards.
Call your bank's 24-hour fraud number first, then report on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the 1930 helpline, and file on the Money Restoration Portal. Keep the acknowledgement, because the 5-calendar-day reporting condition in RBI's June 2026 instructions applies from 1 January 2027.
Read the full guide on AAVETech: Is OTP Fraud Still the Biggest Problem in Indian Banking?.
Send us your OTP and KYC flow, and we will return a fixed-price fraud-resistance review of the authentication path with a written scope.
Talk to an analyst about this.