Haryana Police's Double OTP system against cyber fraud — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 27, 2026

Severity: MEDIUM | View Full Scam Details

Haryana Police's Double OTP System Scam in India 2026: How Cybercriminals Exploit OTP Frauds

The rise of digital payments and Aadhaar-based verifications has given cybercriminals new ways to fool unsuspecting Indians, especially through OTP (One-Time Password) thefts — the Haryana Police's double OTP system scam is a prime example.

What Is the Haryana Police's Double OTP System Against Cyber Fraud?

In 2026, Haryana Police have faced a surge in OTP-related cyber frauds targeting elderly citizens and less tech-savvy individuals. Dubbed the "Double OTP" scam, fraudsters pose as law enforcement or bank officials, claiming to protect victims from fake transactions or fraud. Instead of a simple OTP request, they trick victims into sharing two sets of OTPs — hence the "double" OTP scam — each leading to unauthorized access to personal bank accounts or digital wallets.

This scam mainly targets older Indians familiar with WhatsApp and phone calls, platforms scammers exploit to create false trust. With UPI payments and Aadhaar-based KYC becoming everyday tools, victims often fail to recognize that sharing any OTP with strangers can lead to financial losses. The scam is spreading beyond Haryana, with incident reports coming from multiple states, prompting warnings from agencies like CERT-In and the Indian Cyber Crime Coordination Centre (I4C).

The Reserve Bank of India (RBI) and CERT-In have frequently advised users never to share OTPs, PINs, or passwords with anyone — even if the caller claims to be from the police or bank. While banks implement additional security features, scammers keep innovating by exploiting users’ trust.

How This Scam Works — Step by Step

1. Initial Contact: The victim receives a WhatsApp message or an unsolicited phone call claiming to be from the Haryana Police cybercrime division or their bank fraud team. The caller says suspicious activity was detected on the victim’s bank or UPI account.

2. Creating Urgency: The scammer warns that immediate verification is needed to prevent loss of funds, often asking for partial details about Aadhaar or account numbers to sound convincing.

3. First OTP Request: The victim is asked to share the first OTP received on their phone, supposedly to "confirm identity."

4. Second OTP Request: Before the victim can understand, the caller asks for a second OTP that appears shortly after, claiming it’s needed for an additional security check or system confirmation.

5. Unauthorized Transactions: Using these OTPs, the scammer completes transactions, transfers money via UPI apps like Google Pay or PhonePe, or authorizes new devices or SIM swaps, stealing funds silently.

6. Cutting Off Contact: Once the money is transferred, scammers often block victims on WhatsApp and stop answering calls, leaving victims confused and helpless.

Victims typically lose amounts ranging from a few thousand rupees to lakhs, depending on available bank limits. Banks may refuse reversals once OTP authorization is confirmed, causing significant financial distress.

Real Warning Signs to Watch For

• Caller claims to be from police or bank but uses unofficial or private numbers.
• Requests not only one but two separate OTPs in quick succession.
• Urgent threats or warnings demanding immediate action.
• Asking for confidential details like Aadhaar number, UPI PIN, or password.
• Pressure to install unknown apps for "verification" or "security."
• Reluctance to share official identification or provide a call-back number.
• Blocking or disappearing right after obtaining OTPs or personal info.

What Happens to Victims

Victims face immediate financial loss as funds get drained via UPI or bank transfers. Because OTP confirms user consent legally, banks in India often deny requests for reversal. This leaves many victims without easy recourse.

Beyond money, there’s emotional trauma. Many elderly victims feel shame or guilt for falling prey to scammers. Some experience anxiety over identity theft if Aadhaar details were shared, as misuse risks permanent damage. Cases of SIM swap-related losses—where fraudsters take over mobile numbers—have increased, causing additional inconvenience in restoring mobile services.

In many instances, victims feel isolated because family or friends may not understand the scam’s technical nature, delaying timely reporting to authorities.

What RBI and CERT-In Say

The Reserve Bank of India and CERT-In have repeatedly cautioned users about OTP frauds. RBI’s guidelines explicitly state that no bank or government agency will ask for OTPs or PINs over phone calls or SMS. CERT-In advises users to verify suspicious communication through official helplines and never share sensitive details.

For reporting cybercrime, individuals can contact the National Cyber Crime Reporting Portal or call the Indian Cyber Crime Helpline at 1930. RBI also provides a dedicated helpline for banking fraud victims at 1800-11-5678.

These regulatory bodies continue to urge banks and digital payment platforms to strengthen user authentication and promote public awareness on scams like double OTP frauds.

How to Protect Yourself

1. Never share any OTP or PIN with anyone, no matter who calls or messages.
2. Ignore unsolicited calls or WhatsApp texts claiming to be bank or police officials.
3. Always verify official communication by calling known customer service numbers directly.
4. Do not install apps or click on links shared by unknown contacts requesting OTPs.
5. Enable UPI transaction limits and biometric authentication for extra security.
6. Register your mobile number with Aadhaar and banks carefully to avoid SIM swap fraud.
7. Educate elderly family members about the risks of sharing OTPs and suspicious calls.

What to Do If You've Been Targeted

• Immediately inform your bank or UPI app provider to block accounts or freeze transactions.
• Report the fraud to the National Cyber Crime Reporting Portal (cybercrime.gov.in).
• Call the Indian Cyber Crime Helpline at 1930 for guidance and support.
• Lodge a complaint with local police including details of phone numbers and message screenshots.
• Request the bank for a transaction reversal if possible and keep evidence handy.
• Change passwords and OTP-receiving mobile numbers if you suspect SIM swap.
• Inform family members and BharatSecure.app community to raise awareness.

Frequently Asked Questions

Q: Can Haryana Police really ask for OTPs to protect me?
No. Neither Haryana Police nor any legitimate bank official will ever ask for your OTP over calls or WhatsApp. OTPs are private security codes meant only for you.

Q: What if I accidentally shared OTPs twice with a caller?
Immediately contact your bank/UPI app to block transactions, report the fraud to cybercrime helpline 1930, and file a complaint online. Quick action can limit losses.

Q: How can I verify if a call claiming to be from police is genuine?
Hang up and call official police or bank numbers listed on government or bank websites. Do not trust caller ID alone as scammers spoof numbers sometimes.

Stay alert and protect yourself from Double OTP scams and similar cyber frauds. Whenever you receive suspicious calls or messages asking for OTPs, verify them first at BharatSecure.app — India’s trusted platform for digital fraud awareness and protection.