You read out the six digits, or typed them into a chat, and a second later something felt wrong. Maybe the "bank officer" hung up too quickly. Maybe a debit SMS has just arrived. Your stomach drops.
Take a breath. Sharing an OTP is one of the most common ways people are cheated in India, and it happens to careful people, because the caller is trained to rush you. What matters now is speed and order. Here is what to do.
In the first few minutes
- Stop talking to them. End the call or chat. Don't share another OTP, even if they say it's needed to "cancel" or "reverse" the first one. Don't delete anything; you'll need it later.
- Read the SMS that brought the OTP. Most OTP messages say what the code is for: a payment and its amount, a new payee, a login, a UPI registration, a WhatsApp code or a SIM change. That tells you which door the scammer is trying to open, and which steps below matter most.
- Call your bank and block what's at risk. Use the number on the back of your card or on the bank's own website, never one from a search result or a message. Sanchar Saathi's "Trusted Contact Details" also lists official bank contacts. Ask the bank to block your cards, UPI and net banking for now, and to tell you whether any payment, payee or new device has been added. Write down the complaint number it gives you.
- If money has gone, call 1930. It's the free national cyber crime helpline. The sooner you report, the better the chance that the money can be held in the account it went to. Our guide to calling 1930 lists what to keep ready.
The same day
- File a complaint on cybercrime.gov.in if money moved, even if you've already called 1930. Keep the complaint number with your bank's reference.
- Change your passwords and PINs. Start with net banking and the e-mail account linked to your bank, then your UPI PIN, then shopping and other accounts the OTP might have opened. Where an app offers "sign out of all devices", use it.
- Check your UPI apps. Look at the bank accounts linked in each one and at recent payments. Tell your bank about anything you don't recognise.
- Check that your calls aren't being forwarded. Dial *#21#. If your calls are forwarded and you didn't set that up, dial ##002# to cancel all forwarding. I4C has warned that scammers use forwarding codes so that bank calls and OTP calls ring on their phone instead of yours.
- If the OTP was a WhatsApp code, follow our guide to getting a hacked WhatsApp back. If it was for a SIM or eSIM change, or your phone suddenly has no signal, call your mobile operator from another phone straight away. We explain why in SIM swap and eSIM fraud.
- Save the evidence: screenshots of your call log, the chat, the OTP SMS and any debit messages, plus the number that called you.
In the following days
- Watch your accounts and SMS alerts closely for a few weeks, and report anything new to your bank at once.
- Check the SIMs registered to you on Sanchar Saathi, under "Know Mobile Connections in Your Name", if you also gave the caller your Aadhaar or other ID details. Report any number you didn't take.
- Follow up with your bank and on the portal, using your complaint numbers. If the bank doesn't reply within 30 days, or you're unhappy with its answer, you can complain to the RBI Ombudsman at cms.rbi.org.in within 90 days. It's free.
- Report the caller even if you lost nothing, on Chakshu, in the Sanchar Saathi app or website, within 30 days.
What to expect next
Be ready for an honest conversation with your bank. Under RBI's current rules, first set in July 2017, sharing payment credentials such as an OTP counts as the customer's negligence. That means you can be made to carry the loss until you report it; anything taken after you report is the bank's responsibility. That's why minutes matter. Banks can also choose to waive your share.
New RBI rules apply to transactions from 1 January 2027. They also list giving out an OTP as negligence, but add a once-in-a-lifetime compensation for small losses: 85% of the net loss, up to ₹25,000, on losses of up to ₹50,000, if you report to 1930 or the national cybercrime portal and to your bank within five calendar days. It covers frauds in the rules' first year.
Money that's held in time has the best chance of coming back, but recovery is never guaranteed, and it can take months. Our step-by-step guide for scam victims covers the longer follow-up.
What not to do
- Don't call back the number that called you, or a "helpline" from an SMS or a search result.
- Don't install an app or share your screen because someone says it will stop the fraud.
- Don't pay anyone who offers to recover your money. 1930, the portal, your bank and the police don't charge you.
- Don't stay quiet out of embarrassment. Scammers count on it, and your report helps trace the accounts behind the fraud.
Where BharatCaller fits
BharatCaller, a free Indian caller ID app, can't undo a shared OTP, but it warns you before you answer when other people have reported a number as spam, and you can report and block the number that called you.
Quick answers
I shared the OTP but no money has gone. Am I safe?
Not yet. The code may have been for a login, a new payee or a UPI registration that can be used later. Call your bank, change your passwords and keep watching your account.
Will my bank ask for an OTP to cancel the fraud?
No. RBI says banks, RBI and other genuine organisations never ask for your OTP, PIN, CVV or password. Anyone who does is part of the scam.
Can I get my money back?
Sometimes. It depends mostly on how quickly you report and whether the money can still be held. Report to 1930 and your bank at once, and keep following up.
Do I need a new phone number?
Usually not. What matters is securing your bank, UPI, e-mail and WhatsApp. If your SIM has stopped working without reason, call your operator from another phone.
