Is OTP Fraud Still the Biggest Problem in Indian Banking?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

How do attackers actually steal an OTP in India?

Four methods, in ascending order of technical effort. SIM porting, where the attacker persuades the telecom operator to move the number to their own device, and which needs only a little social engineering plus identity documents. Interception, which historically needed malware and now includes AI voice cloning, so an attacker can call a bank, hold a conversation in the customer's voice, and pass the verification that a bank agent will ask for. OTP relay, where a fraudster posing as a bank or platform agent persuades the customer to read the code aloud, which is still effective because the call has started on a number the customer dialled. And fraudulent KYC, in which a forged document and a cloned voice pass the verification, which is why the I4C warned in June 2026 about deepfakes defeating facial authentication and video-based KYC. What all four share is a reliance on the customer to be the weakest link, which is why banks have changed their scripts.

What changes from 1 January 2027 under the RBI's compensation rules?

RBI's June 2026 instructions, effective 1 January 2027, allow compensation of 85% of net loss or Rs 25,000, whichever is less, for a genuine individual victim whose gross loss is up to Rs 50,000, provided the customer reports to the bank and to the National Cyber Crime Reporting Portal or the 1930 helpline within 5 calendar days. That 5-day window is the operative detail, because a customer who waits a week to see whether the bank reverses the transaction has lost the entitlement. The scale of the underlying problem is what prompted it: Indians have lost over Rs 22,800 crore to telecom fraud and impersonation scams, and 21,900 digital-arrest complaints involving over Rs 647 crore were registered in the first eight months of 2026 alone.

What should a bank or fintech do to make OTP theft harder?

Move away from the one-time password as the sole factor for the highest-risk actions, and add device binding, which ties the OTP request to a specific app installation, a specific device and a specific session. Make the OTP request context-aware, so a code is only valid for a transaction the customer initiated in that session. Never accept an OTP read aloud, and treat a code request that follows a customer-initiated call as suspicious. Add a cooling-off and an out-of-band callback for new beneficiaries and new device enrolments, and make a new device enrolment a hard stop rather than a soft warning. And instrument it: an OTP request from a new device, a new SIM, or a new location should raise an alert to a human, not just a step-up prompt.

What should a customer do in the first hour of an OTP fraud?

Five steps, in order. Call your bank's 24-hour fraud number, not the number in the SMS, and ask for the account to be flagged and the transactions under dispute. Report on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the 1930 helpline, because a freeze depends on speed. File on the Money Restoration Portal and keep the acknowledgement, because the 5-calendar-day reporting condition in RBI's June 2026 instructions applies from 1 January 2027. Report the SIM port or the number transfer to your telecom provider. And preserve evidence, including the SMS, the call details and any payment reference, because the forensic trail in a digital-arrest case runs on timestamps.

What are the common questions about O?