OTP Fraud in Odisha: Is the Bank Liable If You Shared Your OTP?
Sharing an OTP with a fraudster does complicate your claim, but it does not automatically mean the bank owes you nothing — RBI's zero and limited liability framework still applies based on how quickly you report it. Here is what Odisha victims of OTP fraud need to know.
By Advocate Debarchana Samal · 22 July 2026 · 8 min read
The Common Misconception: "I Shared My OTP, So I Have No Case"
OTP fraud has become one of the most common financial crimes reported across Cuttack, Bhubaneswar, and the rest of Odisha — fraudsters posing as bank officials, KYC verification agents, electricity department staff, or even income tax officers to trick victims into revealing an OTP. When banks find out that the victim shared the OTP, many simply close the complaint, telling the customer they are at fault and therefore not entitled to a refund. This is often incorrect. RBI's framework is more nuanced than a simple "you shared it, so you lose" rule — the circumstances of how and why the OTP was shared, and how quickly you reported the fraud, both matter significantly.
RBI's Three-Tier Customer Liability Framework
Zero Liability
Full refund
Applies where the fraud is due to bank/system negligence, or a third-party breach with no customer fault, or where reported within 3 working days
Limited Liability
Capped at ₹5,000–₹25,000
Applies where there is some deficiency on the customer's part but reporting still happens within 4 to 7 working days
Bank's Policy Applies
Determined case-by-case
Applies beyond 7 days or in cases of clear customer negligence, following the bank's board-approved policy
The critical distinction the RBI draws is between negligence and deception. If you handed over your OTP because you were genuinely deceived — a caller impersonating your bank's fraud department, a fake SMS link mimicking your bank's website, or a caller citing personal details to appear credible — this is fraud committed against you, not carelessness by you. Banks are expected to evaluate the full context, not simply deny the claim because an OTP was technically shared.
Step-by-Step: What to Do Right After OTP Fraud
Call the bank helpline the moment you realise it
Report the transaction to your bank's 24x7 fraud helpline immediately, and request that your card, UPI, and net banking access be blocked to prevent further loss.
Submit a detailed written complaint within 3 working days
Follow up with a written complaint describing exactly how you were deceived — the fake caller ID, the impersonated bank official, or the phishing message — since this context is central to your liability determination.
File a cybercrime complaint and FIR
Report on cybercrime.gov.in or call 1930, and register an FIR at your local police station or cyber cell so the criminal investigation and potential fund freezing can begin.
Clearly document the deception, not just the transaction
Preserve call logs, screenshots of fraudulent messages, and any recordings, since proving you were actively deceived — rather than careless — is key to securing zero or limited liability.
Escalate to the RBI Banking Ombudsman if refused
If the bank denies your claim or you are dissatisfied with the resolution, escalate to the RBI Banking Ombudsman at cms.rbi.org.in, citing the specific liability tier you believe applies to your case.
When You Need a Lawyer
Many OTP fraud claims are wrongly rejected by bank staff who apply a blanket "you shared the OTP" logic. You should bring in a lawyer when:
Critical warning: Never share an OTP, CVV, PIN, or net banking password with anyone, regardless of how convincing the caller sounds — no genuine bank, RBI, or government official will ever ask for these details. If you have already shared one, report it within hours, not days — the speed of your report is often the single biggest factor in how much of your money you can recover.
Frequently Asked Questions
If I shared my OTP with a scammer, does that mean I get zero refund?
Not necessarily. RBI's Customer Protection guidelines distinguish between negligence and being a victim of deception. If you shared the OTP because a fraudster posed convincingly as a bank official, government agency, or through a sophisticated phishing scheme, this is treated differently from careless disclosure to a stranger for no reason. Reporting quickly still matters enormously in determining your liability tier.
What is RBI's three-tier liability framework for OTP fraud?
Zero liability applies where the fraud is due to bank negligence, a third-party breach unrelated to your fault, or where you report within 3 working days regardless of fault. Limited liability, capped between ₹5,000 and ₹25,000 depending on the account type, applies where there is deficiency on the customer's part and reporting happens between 4 and 7 working days. Beyond 7 days, or where clear customer negligence exists, liability is determined by the bank's board-approved policy, which can mean full loss to the customer.
How fast do I need to report OTP fraud to protect my claim?
As fast as humanly possible — ideally within minutes to hours of noticing the fraudulent transaction, and certainly within 3 working days to preserve your strongest position under the zero liability window. Every day of delay narrows your legal protection and gives the fraudster more time to move the money beyond recovery.
Should I file both a bank complaint and a cybercrime complaint for OTP fraud?
Yes, both are necessary and serve different purposes. The bank complaint pursues your refund under RBI's liability framework, while the cybercrime complaint (via cybercrime.gov.in, the 1930 helpline, or an FIR) triggers the criminal investigation against the fraudster and can sometimes help freeze the fraudulently transferred funds before they are withdrawn.
Can a lawyer help me if the bank refuses to refund my money after OTP fraud?
Yes. A lawyer can help draft a detailed, persuasive written complaint explaining the deceptive circumstances of the OTP disclosure, represent you before the RBI Banking Ombudsman if the bank refuses, and if necessary pursue a consumer complaint or civil suit citing the bank's failure to apply RBI's liability framework correctly.
Victim of OTP Fraud in Cuttack or Odisha?
Advocate Debarchana Samal helps clients build a strong bank liability claim, escalate to the RBI Banking Ombudsman, and pursue the cybercrime case against the fraudster. Contact us for a confidential consultation.
Disclaimer: This article is for general informational purposes only and does not constitute legal advice. Consult a qualified advocate for advice specific to your situation.
Need Legal Help?
Need Help Recovering Money Lost to OTP Fraud?
Schedule Your Legal Consultation Today
Every legal matter has a time-sensitive dimension — the sooner you seek counsel, the stronger your position.
Serving clients across Cuttack, Bhubaneswar, and all districts of Odisha.