I shared an OTP and money went

Someone called claiming to be from the bank, KYC, the electricity board or a delivery service, took the OTP, and money left your account.

Do this now

  1. Step 1.

    Within 5 minutes

    Call 1930 right now. It is the national cyber-crime helpline and runs 24 hours. The sooner the complaint is on record, the better the chance the bank can freeze the money — the first hour matters most.

    Call 1930
  2. Step 2.

    Within 15 minutes

    Call your bank on its official number — the one printed on the card or passbook — report the transaction as disputed and get the account or card frozen. Note the complaint number. Under the RBI circular, if the breach was a third party's and the deficiency lay neither with the bank nor with you, reporting within three working days of the bank's intimation leaves your liability at zero. But if you passed on the OTP, PIN or password yourself, you bear the entire loss until you report it — and the bank bears any loss after that. Which is why every hour of delay adds to the amount.

  3. Step 3.

    Within 20 minutes

    Change your net-banking and UPI passwords or PINs at once. Change the password of the email linked to the bank as well, and turn on two-step verification.

  4. Step 4.

    Within 30 minutes

    Check the rest of the account activity — these usually come as several small debits, not one. Dispute each unauthorised transaction separately.

  5. Step 5.

    Within the first hour

    File the written complaint at cybercrime.gov.in and save the acknowledgement number. The phone complaint lands on the same portal, but only you can add the written account and the documents.

    File at cybercrime.gov.in
  6. Step 6.

    Within 24 hours

    Go to the nearest police station or cyber cell, give a written complaint and take the acknowledgement. A cyber-crime FIR can be registered at any police station — you cannot be turned away on the ground that it is not their jurisdiction.

Do not do this

  • Never share an OTP, UPI PIN, CVV or password with anyone — including someone claiming to be from your bank, the police or a 'cyber cell'. No real official ever asks.
  • Do not call the number back or open any link they sent. Take the bank's number from your card, passbook or the bank's own website.
  • Do not pay another rupee to 'release your refund' or 'close the case'. Anyone who asks for money to get your money back is running a second fraud.
  • Do not delete the chat, call log, email or messages — not even out of anger. That is your evidence, and it does not come back.

Preserve this evidence

  • Any call recording you have, plus a screenshot of the call log showing the number and duration.
  • Screenshot every screen with the date and time visible — the chat, the payment screen, the email, the profile.
  • The UTR or reference number of every transaction, the amount, the time, and the full details of the account or UPI ID the money went to.
  • The sender's phone number, UPI ID, email address, WhatsApp profile, and the link to any social-media account they contacted you from.
  • The bank statement or passbook entry for the day of the incident, as a PDF or a photo.

Similar cases

No cases recorded in this category yet.

National helplines

State cyber cells

This is educational information, not legal advice. For anything serious, speak to an advocate.