Impersonation OTP Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Aug 27, 2026

Severity: Critical | View Full Scam Details

OTP Impersonation Scams in India 2026: How Fake Government Callers Are Draining Bank Accounts

Fraudsters posing as government officials and bank employees are stealing OTPs from unsuspecting Indians — and in 2022 alone, reported losses crossed ₹1,000 crore. With UPI transactions and Aadhaar-linked services now central to daily life, this scam is rated critical (risk score 10/10) and is getting more sophisticated every year.

What Is the Impersonation OTP Scam?

In this scam, callers falsely claim to represent trusted institutions — the Income Tax department, UIDAI, RBI, or your bank — and manipulate you into sharing the OTP sent to your phone. That single six-digit number is all they need to authorise a transaction, reset your UPI PIN, or access your account.

The scam disproportionately targets people who are not deeply familiar with how OTPs work: first-time UPI users, senior citizens, and anyone who has recently completed a transaction that triggered an OTP verification. Scammers actively research potential victims through WhatsApp, Facebook, and other social platforms before making contact.

The Ministry of Home Affairs has flagged a sharp rise in financial cybercrimes of this type, and both RBI and CERT-In have issued public warnings urging consumers never to share OTPs with anyone. BharatSecure's threat-intelligence database has identified 2 government-impersonation domains verified by CERT-In that have been used in campaigns matching this pattern.

Exactly How This Scam Works — Step by Step

1. Target selection. Alleged scammers identify victims via social media or messaging apps, often choosing people who recently completed a UPI transfer or Aadhaar-linked service — indicating they are active digital-finance users.

2. First contact. You receive a call or WhatsApp message from someone claiming to be a bank employee, tax official, or UIDAI representative. The caller ID may be spoofed to look official.

3. The urgency trap. The caller states there is a "discrepancy" with your account, Aadhaar, or mobile number requiring immediate verification. A typical reported script: "Your UPI transaction is flagged — share the OTP or your account will be suspended."

4. OTP request. Moments later, a legitimate OTP arrives on your phone — triggered because the caller (or an associate) is simultaneously attempting a transaction or account change on your behalf.

5. You share the OTP. Under pressure, you read out the code, believing it confirms a "fix."

6. Money is transferred. The OTP authorises a UPI payment, net-banking transfer, or SIM-swap request. Funds leave your account within seconds.

Real Warning Signs (What to Watch For)

• Caller claims your UPI, Aadhaar, or bank account has a "flagged" or "faulty" transaction needing urgent OTP verification
• You receive an unsolicited OTP on your phone immediately after or during the call
• The caller pressures you to act right now — "account will be suspended otherwise"
• Contact arrives via WhatsApp from a number you don't recognise, sometimes with a government logo as the profile photo
• The caller asks for any sensitive information — OTP, full card number, CVV, or UPI PIN — over the phone
• The "official" cannot provide a verifiable employee ID or official email address

What Happens to Victims

Financial losses are often immediate and hard to recover. UPI transactions are near-instant, and the RBI's framework for disputed transactions requires you to report within three working days for maximum liability protection — a window many victims miss because they only realise the fraud later. Aadhaar-linked misuse can compound the damage if the scammer uses your identity to open new payment accounts.

Beyond money, victims report significant emotional distress, shame, and a lasting loss of confidence in digital payments — which is precisely why awareness is a public-safety priority, not just a personal one.

What RBI, CERT-In, and I4C Say

RBI has repeatedly clarified in public communications that no bank or regulatory body will ever ask for your OTP, PIN, or card details over a phone call. If you receive such a call, it is not from your bank.

CERT-In (cert-in.org.in) tracks active phishing domains and impersonation campaigns; its advisories urge users to verify any unsolicited contact through official website numbers only.

I4C (Indian Cybercrime Coordination Centre) operates the 1930 Cybercrime Helpline — call immediately if you suspect fraud. Online complaints can be filed at cybercrime.gov.in. Under the Bharatiya Nyaya Sanhita (BNS) 2023 and IT Act 2000, impersonation and digital fraud are cognisable offences.

How to Protect Yourself

1. Never share an OTP with anyone — not a caller claiming to be from your bank, RBI, UIDAI, or a tax office. No legitimate body ever asks for this.
2. Hang up and call back using the number printed on your bank card or the institution's official website — never the number that called you.
3. Enable transaction alerts on your bank app so you spot unauthorised activity in real time.
4. Lock your Aadhaar biometrics via the UIDAI portal or mAadhaar app when not in active use.
5. Set a UPI daily transaction limit low enough that a single fraudulent transfer causes minimal damage.
6. Verify suspicious WhatsApp profiles — official government agencies do not initiate contact through personal WhatsApp numbers.
7. Talk to family members who are less familiar with digital finance; this scam specifically targets people new to UPI and Aadhaar-linked services.

What to Do If You've Been Targeted

1. Call 1930 immediately — India's national cybercrime helpline can attempt to flag and freeze the transaction.
2. File a complaint at cybercrime.gov.in — keep your call log, transaction ID, and screenshots ready.
3. Contact your bank's 24-hour helpline to freeze your account and dispute the transaction within three working days.
4. Block your UPI apps through your bank's customer care or by changing your UPI PIN right away.
5. Lock your Aadhaar via uidai.gov.in if you shared any Aadhaar-related details during the call.
6. Preserve all evidence — do not delete messages, call logs, or transaction records before filing your complaint.

Frequently Asked Questions

Why do I receive a real OTP if the call is from a scammer? The OTP is real — the alleged scammer triggers it by initiating an actual transaction or account-change request on your account at the same moment they call you. Sharing it completes their action, not a "verification" on your behalf.

Can I get my money back after a UPI fraud? Possibly, but time is critical. RBI guidelines place reduced liability on the customer if the fraud is reported within three working days and the bank is notified promptly. File with 1930 and your bank simultaneously — do not wait. For case-specific legal guidance, consult a lawyer or your bank's grievance officer.

Is it safe to share my Aadhaar number on a call? No. Your Aadhaar number, combined with other details a scammer may already have, can be used to attempt e-KYC verifications. Share Aadhaar details only on official, verified portals — never verbally over a call.

How do I verify if a caller is genuinely from my bank or a government agency? Hang up and call the institution directly using the number on their official website or the back of your bank card. Genuine institutions will have a record of any real issue with your account and will not object to you calling back on an official line.

Spotted a suspicious message claiming to be from a government agency or your bank? Scan it instantly at BharatSecure.app and report any fraud to the 1930 Cybercrime Helpline or file at cybercrime.gov.in.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.