It is one of the most terrifying notifications you can receive: an SMS stating that thousands of rupees have been debited from your account, yet you never shared a PIN or received an OTP.
How is this possible? And more importantly, how do you get your money back?
How Scammers Bypass OTPs
Cybercriminals are evolving. Here are the most common ways they deduct money without needing an OTP:
1. International Point of Sale (POS) & E-Commerce
Most Indian websites require 3D-secure (OTP) authentication, but many international websites (like Facebook Ads, Google Ads, or foreign merchants) process payments based only on the 16-digit card number, expiry date, and CVV. If your card details were compromised in a data breach, scammers can use them internationally without triggering an OTP.
2. Auto-Debit Mandates (e-NACH)
Scammers sometimes trick victims into signing an e-NACH or standing instruction mandate (often disguised as a Re 1 payment). Once approved, they can deduct money monthly without asking for OTPs.
3. Malware / SMS Forwarding
You did receive an OTP, but you never saw it. If you accidentally downloaded a malicious APK (like a fake electricity bill app), the app can silently read your incoming SMS and forward the OTP to the scammer before deleting the message from your inbox.
RBI Guidelines: Zero Liability for Customers
The Reserve Bank of India (RBI) has strict guidelines protecting you (RBI/2017-18/15). If the unauthorized transaction occurred due to a third-party breach (neither the bank's fault nor yours), you have Zero Liability provided you notify the bank within 3 working days.
If you notify the bank between 4 to 7 working days, your liability is capped (usually at ₹25,000 max for basic accounts).
Step-by-Step Action Plan to Get a Refund
Step 1: Block Your Card/Account Immediately
Do not wait. Call your bank's toll-free helpline or use their official app to block the debit card, credit card, or net banking access to stop further transactions.
Step 2: Register a Formal Dispute with the Bank
Calling customer care is not enough. You must send a written email to your bank's Nodal Officer or dispute desk containing:
- The exact transaction amount
- Date and time
- The 12-digit UTR or Reference Number
Step 3: File a Cyber Cell Complaint
To force the bank to take your claim seriously, you must file a formal police complaint. You can use our Free Cyber Complaint Generator to automatically draft a legally sound PDF complaint addressed to the Cyber Police. Call the National Cyber Helpline at 1930 immediately so they can attempt to freeze the merchant account where your money went.
Remember: Time is of the essence. The faster you act within the "Golden 2-Hour Window," the higher your chances of freezing the funds before the scammers withdraw them as cash.
Need to file an official complaint?
Use our automated utility to draft a precise Cyber Cell application and escalate to your bank's nodal officer instantly.
Open Complaint Generator