A message warning that your debit card will be blocked, followed by a call from someone claiming to be a bank official, can be enough to make even a cautious customer act in haste. Fraudsters exploit precisely this moment of panic, persuading people to share one-time passwords (OTPs), disclose banking credentials, or install malicious applications. When money disappears from an account, however, victims often face a second challenge: establishing their right to seek reimbursement from the bank.A case involving a retired teacher and the State Bank of India (SBI) highlights why customers should know how these scams work and what the law says about unauthorised electronic transactions.In Remadevi T.L. v. State Bank of India, a phishing scam allegedly cost the customer Rs 3.73 lakh. The fraudsters exploited a banking announcement about the proposed blocking of non-chip debit cards to make their message appear credible. In July 2019, the teacher received an SMS at around 9.40 am warning that her debit card would be blocked. A phone call followed, and she was persuaded to share OTPs under the pretext of registering for a purported ‘State Bank Secure App’.Within minutes, Rs 3.73 lakh was debited through unauthorised transactions. The customer reported the fraud to SBI’s customer care at 10.31 am, just 51 minutes after the initial alert. Subsequent police investigation identified a mechanism involving four Spice Digital wallets registered using different phone numbers.The case illustrates a familiar pattern in cyber fraud: criminals do not necessarily need to hack a bank’s systems if they can manipulate customers into handing over the information needed to access their money.Urgency, fraudsters’ biggest weaponMessages threatening account suspension, card deactivation, or disruption of banking services are designed to prevent customers from stopping to verify the information. A caller who uses banking terminology or refers to a genuine policy change can make the deception appear legitimate. Customers may then be persuaded to disclose an OTP or download an application that gives fraudsters access to sensitive information.Here’s what you must keep in mind:Never share your OTP, PIN, password, or MPIN with anyone, even if the caller claims to represent your bank.If you receive a message warning that your account or card will be blocked, verify it independently through the bank’s official app, website, or customer-care number.Never use phone numbers or click links provided in suspicious messages.But what happens if a customer has already shared an OTP and money has been debited? Does that automatically make the customer responsible for the entire loss?Story continues below this adThe answer depends on the circumstances of the transaction, the applicable Reserve Bank of India (RBI) rules, and the evidence available.The RBI’s framework on customer protection in unauthorised electronic banking transactions distinguishes between cases involving a bank’s negligence or deficiency, third-party breaches and customer negligence. These categories carry different implications for financial liability.Also Read | Honey trap scams: Warning signs and how to stay safe onlineUnder the framework, customers can have zero liability where an unauthorised transaction results from contributory fraud, negligence or deficiency on the bank’s part.In certain cases involving third-party breach, where neither the bank nor the customer is responsible for the deficiency, customers can also qualify for zero liability if they notify the bank within three working days of receiving the transaction communication.Story continues below this adWhere a loss is attributable to customer negligence, including sharing payment credentials, the RBI framework provides that the customer bears the loss until the unauthorised transaction is reported to the bank. Any further loss occurring after the report is to be borne by the bank.For specified third-party breaches reported after four to seven working days, the framework provides for limited customer liability, subject to the applicable account category and conditions.This makes prompt reporting critical. Customers should not wait to determine exactly how the fraud occurred before informing the bank. The time of reporting can become important evidence in a subsequent dispute.“A bank is fully liable when the fraud results from its own negligence or deficiency, such as weak security, failure to send alerts, internal fraud, or failure to act quickly once the customer reports the fraud. It is also liable for any loss that occurs after the customer has reported the fraud. To hold the customer responsible, the bank should produce proof to establish negligence on the part of the customer,” said Prasanth Sugathan, legal director, Software Freedom Law Centre.Story continues below this adHe further added that sharing an OTP does not automatically defeat a claim. The bank should prove with reliable material that the customer was negligent. Being tricked by someone impersonating the bank is very different from carelessly handing out credentials.However, banks cannot necessarily settle every claim merely by pointing out that an OTP was shared. The circumstances in which the information was disclosed, the nature of the unauthorised transactions and the evidence of negligence must also be considered.Also Read | When bullying follows a child home: How parents can spot cyberbullyingIn State Bank of India v. Dr. Dilip Kumar Barua, the Guwahati High Court emphasised that a bank must establish customer negligence through reliable material rather than rely on an unsupported allegation.The distinction is important: a customer deliberately authorising a transaction is not the same as a customer being deceived into revealing information that a fraudster subsequently misuses.Story continues below this adWhether the customer’s conduct amounts to negligence for liability must be examined in the context of the applicable rules and evidence. These judgments do not, however, mean that every customer who shares an OTP is automatically entitled to reimbursement.In the Kerala High Court case, the customer’s prompt complaint was significant. The supplied material records that SBI failed to take certain recovery-related steps, including promptly approaching the appropriate authorities and initiating a chargeback request with the beneficiary bank. The customer’s claim had also been rejected by the Banking Ombudsman on two occasions before the High Court set aside the orders.The case serves as a reminder that customers should seek a reasoned explanation if a bank rejects their claim. A complaint should not end with a verbal assurance or refusal. Account holders should preserve the complaint number, the date and time of reporting, transaction alerts and all correspondence with the bank.If you discover an unauthorised debit, act immediately: Contact your bank: Report the transaction through an official channel and ask the bank to secure your account, block compromised cards or digital banking access where necessary, and investigate the disputed debits.Story continues below this adFile a written complaint: Record the amounts debited, transaction timings and circumstances of the fraud. Keep the bank’s acknowledgement as proof of when you reported the incident.Report the fraud: Inform the police or report the incident through the national cybercrime reporting portal.Preserve evidence: Save suspicious messages, phone numbers, call records, transaction statements and screenshots. These may help investigators trace the fraud and the bank examine your claim.Secure your device: If you installed an application at the caller’s request, inform the bank and investigating authorities, and take steps to secure your device and banking credentials.Story continues below this adChallenge a rejected claim: If the bank refuses reimbursement because you shared an OTP, ask for a written explanation and the basis for its decision on liability.Escalate the complaint: If the dispute remains unresolved, use the bank’s grievance-redressal process and explore the RBI Integrated Ombudsman Scheme, where eligible. Further legal remedies may be available depending on the circumstances.Understand the limitations: Prompt reporting or filing a police complaint does not guarantee recovery. The outcome depends on the applicable rules and evidence.Remember:Cybercriminals exploit panic, trust, and delayed action. Even a message referring to a genuine bank policy can be fraudulent.Story continues below this adVerify unusual requests independently and monitor your bank account for suspicious activity.Report fraud without delay and retain all complaint acknowledgements.Sharing an OTP is a serious security risk, but a bank’s initial rejection does not necessarily end your right to challenge the decision.Understanding the applicable rules, preserving evidence, and following the proper complaint process are essential steps towards seeking redress.The safe sideAs the world evolves, the digital landscape does too, bringing new opportunities—and new risks. Scammers are becoming more sophisticated, exploiting vulnerabilities to their advantage. In our special feature series, we delve into the latest cybercrime trends and provide practical tips to help you stay informed, secure, and vigilant online.