OTP scams: why nobody should ever hear your OTP

A one-time password is the final lock on your money and accounts. Anyone who asks you to read it out is trying to open that lock.

Why the OTP matters

When a bank, wallet or app sends you a one-time password, it is asking: "is this really you?" Typing the code is your yes. If you give the code to someone else, they answer yes in your name. The system cannot tell the difference, and under the Reserve Bank of India's rules a loss caused by sharing payment credentials falls on the customer until it is reported. See who bears the loss.

The stories used to get it

• "I am from your bank." Your card is being upgraded, a suspicious transaction must be cancelled, reward points are expiring. "Just confirm the code sent to you."
• The delivery or courier call. "Your parcel needs a verification code." A real delivery code is given to the rider at your door, for a parcel you ordered, and the message says what it is for.
• The wrong-number plea. "I typed your number by mistake while registering. Please send me the code you received." The code is the login code of your own WhatsApp or another account.
• The friend in need. A message from a known contact, whose account has already been taken over, asks you to forward a code.
• The job, loan or prize. A code is needed "to register you".
• The SIM upgrade. "Confirm the code to activate 5G or your e-SIM." This one hands over your phone number itself. See SIM swap.

Read the message, not just the number

Every genuine OTP message says what the code will do: "is your OTP to pay Rs 24,999 at ...", "to log in", "to add a payee", "to register WhatsApp on a new device". Read the whole line before you use any code. If it describes something you are not doing yourself, right now, on your own screen, someone else started it.

The rule

An OTP is typed only by you, only into a screen you opened yourself. It is never read out on a call, never sent in a chat, never typed into a page that arrived by link. No bank employee, police officer, courier, friend or relative has a genuine reason to hear it.

More protection

• Turn on an app lock and hide message previews on the lock screen, so that a code cannot be read off a locked phone. See Android settings and iPhone settings.
• Prefer an authenticator app or passkey over SMS codes where the service offers it. See two-step verification.
• Turn on two-step verification in WhatsApp, so that the SMS code alone cannot move your account. See WhatsApp settings.
• An OTP you did not ask for means someone has your password or number and is trying. Do not share it; change that account's password.

If money has already gone

1. Dial 1930 at once. It is the national helpline for victims of financial cyber fraud. Give the transaction details; the earlier the report, the better the chance that the money can be held before it is moved on.
2. Call your bank or card company on its official number and block the card, UPI or account. Report the transaction as unauthorised and note the complaint number.
3. File the complaint on the National Cyber Crime Reporting Portal, cybercrime.gov.in, and keep the acknowledgement number.
4. Keep everything: screenshots, numbers, UPI IDs, account numbers, transaction references, links, the app's name. Do not delete chats.

The full checklist, with what to keep ready, is on what to do after a fraud. Helpline and portal checked on 12 November 2026.

Independent guide. This is not a government, bank or police website. Helplines and rules were checked at official sources on 12 November 2026; confirm on the official site before relying on them.