That Call from "Your Bank": Understanding CVV/OTP Sharing Fraud
Most people picture a cyber criminal as someone typing furiously in a dark room, breaking through firewalls. The reality is far more ordinary. Often it is just a phone call, a calm voice, and a customer who wants to be helpful. CVV/OTP sharing fraud works exactly this way, and it belongs to the wider family of social engineering fraud, where the attacker manipulates a person instead of breaking a machine.
What the fraud looks like
The script is almost always the same. A stranger calls, claiming to be from the bank or even the Reserve Bank of India. The message is urgent: your ATM card has been blocked, your KYC is not updated, or your Aadhaar is not linked to your account, and unless you act now, the account will be shut.
The caller then offers a quick fix. To "update the KYC", "link the Aadhaar", "restore the card" or "activate a new card", they ask for a few details: the card number, the CVV printed on the back, and finally the OTP that arrives on your phone a moment later.
That last step is the trap. Once the OTP is read out, the money leaves the account. Usually it is moved into an e-wallet or a UPI account, or spent immediately on online shopping, so that it is hard to trace or recover.
Why intelligent people still fall for it
It is tempting to blame the victim's carelessness. Research on fraud suggests otherwise. These calls are built to exploit ordinary human reactions:
Authority. A caller who sounds official, uses banking vocabulary and quotes the RBI is hard to doubt.
Fear of loss. Nobody wants a blocked account, particularly if salary, savings or a pension sits in it.
Urgency. "Within the next hour" leaves no room to stop and think, or to ask a family member.
A believable reason. KYC and Aadhaar linking are real requirements that many customers have actually been asked to complete, so the story feels familiar.
The fraudster does not need to be technically skilled. They need to be convincing for about five minutes.
Why the bank's security does not save you
The card number, CVV and OTP together form the keys to an online transaction. The CVV shows that the person holding the details also holds the card. The OTP, sent to the registered mobile number, is the bank's way of confirming that the genuine customer consents to this particular payment.
When a victim reads the OTP aloud, the system sees a customer approving a transaction, because technically that is what happened. The security measure worked as designed; the person was tricked into using it for the wrong party. This is why awareness matters more than any software patch.
The legal picture
This offence can attract several provisions at once. Typically they include:
Information Technology Act, 2000: Section 66C (dishonest use of another person's identifying information) and Section 66D (cheating by personation using a computer resource).
Bharatiya Nyaya Sanhita, 2023: the provisions on cheating, including cheating by personation, which replaced the corresponding sections of the Indian Penal Code.
Which sections are finally applied depends on the facts of each FIR and the investigating agency's assessment.
Warning signs
The caller contacted you first and is pushing you to act quickly.
You are asked for a card number, CVV, PIN or OTP, in any form.
The call moves to WhatsApp or SMS, or you are asked to install an app.
You are told your account will be "blocked" unless you cooperate immediately.
Simple rules that protect you
A bank never asks for your card number, CVV or OTP. Not on a call, not by SMS, not on WhatsApp.
Do not share confidential banking credentials with anyone, however official they sound.
Be careful with your email address and other personal details. In the wrong hands, these can help a fraudster get internet banking activated or reset passwords, which leads to money being drained from your account.
Hang up and call back. End the call, then dial the number printed on the back of your card or on the bank's official website.
Pause before you act. A genuine problem will still be there ten minutes later. A scam relies on you not waiting.
If you have already shared the details
Speed matters more than embarrassment.
Call your bank immediately and ask to block the card and freeze the account or the disputed transaction.
Call the National Cyber Crime Helpline, 1930, as soon as possible.
File a complaint on the national cybercrime reporting portal, cybercrime.gov.in.
Keep the call details, messages, transaction IDs and screenshots.
Report quickly. Under RBI's customer protection framework, a customer who reports an unauthorised electronic transaction within three working days generally has zero liability when the fault lies elsewhere in the system. Delays can reduce that protection.
Final thought
CVV/OTP sharing fraud is not a battle between a clever criminal and a careless citizen. It is a contest between a rehearsed script and a person caught off guard. The best defence is a habit anyone can learn: your card number, CVV and OTP are yours alone. If someone asks for them, that request is the warning.
Ritika sood
Comments
No comments yet.