OTP Fraud and Vishing Scams in India — How They Work, How They Differ from SIM-Swap Fraud, and Legal Remedies

This article is for educational and legal awareness purposes only. It does not constitute legal advice or solicitation. Please consult a qualified advocate for advice on specific legal matters.

Overview

A one-time password (OTP) is meant to be the last line of defence on a bank transaction — a code sent to a device only the account holder controls. Fraudsters have built an entire playbook around defeating that safeguard without ever needing to “hack” a bank’s systems. This is broadly called vishing, or voice phishing: a phone call, SMS, or WhatsApp message that manipulates the victim into disclosing an OTP or into performing an action that lets the OTP be intercepted. It is frequently confused with SIM-swap fraud, which achieves a similar result — a fraudster receiving the victim’s OTP — through an entirely different method. This article explains how each works, why the distinction matters legally, the criminal provisions that apply, and a recent set of Delhi High Court rulings on who bears the loss when an OTP-based fraud succeeds.

How Vishing and OTP Fraud Typically Operate

Common patterns seen in vishing and OTP-fraud complaints include:

Fake bank or KYC-update calls — a caller claiming to be from the victim’s bank states that the account, debit card, or KYC will be blocked unless the victim “verifies” by sharing an OTP just sent to their phone.
Phishing-link-to-OTP chains — a caller or SMS induces the victim to click a link (often disguised as a courier-delivery, electricity-bill, or refund link) and enter card or net-banking details on a fake page; the OTP that follows is then read out under pretext, or auto-captured where the victim has been induced to install a screen-sharing or remote-access app.
Fake customer-care numbers — victims searching online for a bank’s or e-commerce platform’s customer-care number are shown a fraudulent number seeded on search results or business directories; the “executive” who answers directs the victim through steps that end in an OTP being read out.
Digital-arrest and impersonation calls — a caller posing as a police officer, RBI official, or customs officer alleges the victim’s identity has been used in a crime, creates panic, and extracts banking credentials or an OTP as part of a purported “verification.”
Remote-access app installation — the victim is talked into installing an app such as AnyDesk or TeamViewer “to fix an issue,” which gives the fraudster a live view of the OTP as it arrives on screen, without the victim needing to read it aloud at all.

Vishing vs SIM-Swap Fraud — Two Different Mechanisms

The two frauds are often lumped together because both end with the fraudster obtaining an OTP, but the method — and consequently the evidence and the applicable provisions — differs:

Vishing / OTP fraud: the victim’s phone number and SIM remain entirely under the victim’s control. The fraudster never intercepts the OTP electronically; the victim is persuaded, through social engineering over a call, SMS, or malicious app, to disclose the OTP or to take an action that reveals it. The victim typically continues to receive calls and messages normally throughout.
SIM-swap fraud: the fraudster, using the victim’s leaked personal details, approaches a telecom outlet with forged identity documents and requests a “duplicate SIM” or number-porting, claiming the original SIM is lost or damaged. Once the telecom operator deactivates the genuine SIM and activates the duplicate one in the fraudster’s possession, the victim’s phone loses network signal, and the fraudster begins directly receiving the victim’s OTPs and call/SMS traffic. A sudden, unexplained loss of mobile signal is the classic warning sign of a SIM swap in progress, unlike vishing, where the victim’s phone works normally throughout.

This distinction matters for two reasons. First, the evidence trail differs — a vishing complaint typically has call-detail records and app-installation logs; a SIM-swap complaint requires records from the telecom operator showing when and where the duplicate SIM was issued, and often forged identity proof used at the point of sale. Second, courts assessing a bank’s or a customer’s liability for the resulting loss look closely at whether the customer did anything (such as sharing an OTP or clicking a link) that could amount to negligence — a question that arises differently depending on which of the two frauds occurred.

The Statutory Framework

Cheating by Personation — Section 319, Bharatiya Nyaya Sanhita, 2023

A caller who falsely claims to be a bank official, police officer, or government functionary in order to extract an OTP or banking credentials commits cheating by personation under Section 319 of the Bharatiya Nyaya Sanhita, 2023 (BNS), which defines the offence as cheating “by pretending to be some other person, or by knowingly substituting one person for another, or representing that he or any other person is a person other than he or such other person really is” — an offence committed whether the person impersonated is real or imaginary. It is punishable with imprisonment of either description for a term which may extend to five years, or with fine, or with both. Where the fraud also results in the victim being induced to part with money, the general cheating provision, Section 318 of the BNS, applies alongside it.

Information Technology Act, 2000

Because vishing and OTP fraud are invariably carried out through a phone call, SMS, or app — a “communication device or computer resource” — two IT Act provisions apply directly:

Section 66D punishes cheating by personation using a communication device or computer resource with imprisonment up to three years and a fine which may extend to one lakh rupees. A vishing call or a spoofed customer-care number falls squarely within this provision.
Section 66C punishes fraudulent or dishonest use of another person’s password, electronic signature, or unique identification feature, with imprisonment up to three years and a fine which may extend to one lakh rupees. This applies once the fraudster uses the harvested OTP or credentials to log in or authorise a transaction.

Where a SIM swap is achieved using forged identity documents submitted to a telecom outlet, the forgery itself is separately punishable, and the subsequent use of the resulting access to commit cheating attracts the same Sections 318/319 BNS and 66C/66D IT Act analysis set out above.

Key Case Law — Who Bears the Loss

A vishing complaint against a bank almost always turns on the RBI’s 2017 circular on customer liability — Customer Protection: Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, dated 6 July 2017 — under which a customer bears the entire loss where the loss is due to the customer’s own negligence, such as sharing payment credentials, but the bank is liable where the loss stems from a deficiency on the bank’s part and no customer negligence is shown. Two rulings of the Delhi High Court in the same matter show how differently this line can be drawn.

In Hare Ram Singh v. Reserve Bank of India & Ors., a Single Judge of the Delhi High Court held, on 18 November 2024, that a customer who received a vishing call and clicked a malicious link — but never read out an OTP or shared his password — had not been negligent within the meaning of the RBI circular, and that the compromise of two-factor authentication through the link was a deficiency in the bank’s security, not the customer’s fault. The bank was directed to compensate the customer in full, with interest.

On appeal, a Division Bench of the same High Court, in State Bank of India v. Hare Ram Singh & Anr. (LPA 52/2025), took a broader view of what counts as customer negligence, holding on 29 May 2026 that negligence under Clause 7(i) of the 2017 circular “cannot be confined solely to cases of express disclosure of OTPs or passwords” and may equally arise where a customer, “despite repeated advisories and security warnings, accesses suspicious or unknown links.” Finding no technical evidence of a breach in the bank’s own security systems, the Division Bench set aside the Single Judge’s order and held the loss to be the customer’s own.

The two orders in the same case illustrate that liability for OTP fraud is not a settled, one-way rule in the customer’s favour — courts scrutinise the customer’s own conduct, including whether a link was clicked or an unfamiliar app installed, and not merely whether an OTP was verbally disclosed.

How and Where to Report

Call the national cybercrime helpline, 1930, immediately — timely reporting improves the chance that the receiving bank can freeze the fraudulent transaction before the funds are withdrawn.
File a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in), run by the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs, and separately notify the bank in writing to trigger the RBI liability framework.
Where a SIM swap is suspected — a sudden, unexplained loss of mobile network signal, followed by an inability to receive calls or SMS — report to the telecom operator immediately to block the fraudulent SIM, and use the Department of Telecommunications’ Sanchar Saathi portal: its Chakshu facility to report the suspected fraud communication, and its TAFCOP (Know Mobile Connections in Your Name) facility to check whether any unauthorised connection has been issued in one’s name.
Lodge an FIR at the local police station or cyber cell, citing Sections 318/319 of the BNS and Sections 66C/66D of the IT Act, along with any forgery provision where a duplicate SIM was fraudulently procured.
Preserve evidence — call logs, the caller’s number, SMS/WhatsApp screenshots, the phishing link if any, and the bank’s transaction alerts — before it is lost or overwritten.

Practical Points to Remember

No bank, police officer, or government official will ever ask for an OTP over a phone call — an OTP is meant to be entered only by the account holder on the bank’s own app or website.
Clicking a suspicious link, or installing a remote-access app at a caller’s instruction, can itself be treated as negligence for the purpose of the RBI liability framework, even if the OTP was never read aloud.
An unexplained loss of mobile network signal — not just a “no service” patch — is the clearest early warning of a SIM swap in progress and warrants an immediate call to the telecom operator.
Whether a particular loss falls on the bank or the customer depends on the specific facts and evidence, and a person facing such a dispute with a bank or the Banking Ombudsman may consider consulting a qualified advocate.

Takeaway

Vishing and OTP fraud rely on persuading the victim to hand over a safeguard that no technical intrusion could otherwise breach, while SIM-swap fraud bypasses the victim altogether by fraudulently substituting the SIM itself — a distinction that shapes both the evidence a victim must gather and the outcome of a liability dispute with the bank. Both are punishable as cheating by personation under Section 319 of the Bharatiya Nyaya Sanhita, 2023, and Section 66D of the Information Technology Act, 2000, with Section 66C applying to the subsequent misuse of the harvested credentials. As the Delhi High Court’s Single Judge and Division Bench rulings in the Hare Ram Singh litigation show, whether the resulting loss falls on the bank or the customer under the RBI’s 2017 liability circular depends closely on the customer’s own conduct — not merely on whether an OTP was verbally disclosed.

Useful Resources

Disclaimer: The information provided on this website is for general legal awareness and educational purposes only. It does not constitute legal advice, advertisement, or solicitation. No reader should act or refrain from acting based on this information without seeking professional legal counsel. Advocate Akhil Singh and this website are not liable for any actions taken based on the content provided herein.