Fake Customer Care Number Scam in India: What to Do Right Now

Short answer: if you have already called a “customer care” number you found online and shared an OTP, a PIN or card details, or let the caller install a screen-sharing app, do four things in this order: block your card and UPI through the bank’s official number (the one on its own website), call 1930 and file at cybercrime.gov.in, remove the app and change your passwords, and put your report to the bank in writing the same day. The RBI warns that contact numbers shown on internet search engines “may be fraudulent”, and it says to get a company’s contact details only from its official website.

General consumer information, not legal advice. Quotes are from RBI, PIB and Department of Telecommunications material checked on 12 October 2026. How much of a loss comes back depends on speed and on how the money was authorised.

How this scam works

You need help with a refund, a blocked account, a delivery or a KYC update, so you search for the company’s customer care number and call the first one that appears. The person who answers sounds helpful, then asks for something the real company would never ask for: an OTP, a card number, your UPI PIN, or permission to install an app “so we can see your screen and fix it”. The app lets them watch and control your phone or computer and reach your banking credentials.

RBI’s own consumer-awareness material describes exactly this. Its press release of 28 January 2022 (2021-2022/1630) lists “fake numbers of banks / e-wallet providers on webpages / social media and displayed by search engines” as a fraud method and says: “Contact numbers on internet search engines may be fraudulent. Always access the official website of bank / NBFC / e-wallet provider for contact details.” RBI’s “BE(A)WARE” awareness booklet adds that the numbers shown on search-result pages “are often camouflaged by fraudsters” and that “customer care numbers are never in the form of mobile numbers”. On screen-sharing apps it says fraudsters trick customers into downloading them to watch or control the device, and tells customers not to download such apps when a company executive contacts them through a personal number, and to remove the app as soon as the work is done.

What to do right now

1. Call your bank on the number printed on its official website, not the number you were just using. Block the debit or credit card, and ask it to freeze debits on the linked account. RBI’s booklet also says to check that other channels, such as net banking and mobile banking, are safe.
2. Call 1930 and file at cybercrime.gov.in. This is the route for money already lost. The helpline exists for prompt reporting and, where possible, freezing of fraudulent transactions; the sooner it is called, the more likely a freeze is still possible.
3. Uninstall the remote-access or screen-sharing app, then change the passwords for your email, banking apps and UPI from a device you trust. RBI’s booklet advises a factory reset of the mobile if a fraud has happened because of a data leak from it.
4. Write to your bank the same day, quoting the transactions and saying when you first noticed them. A written record proves when you reported, and RBI’s liability rules run on that date.
5. Keep the evidence: the number you called, call log, screenshots of the search result, SMS and the transaction entries. See preserving evidence before an app deletes it.

Will the bank cover the loss?

It depends on how the money left. RBI’s circular of 6 July 2017 (RBI/2017-18/15) says that where the loss is due to customer negligence, “such as where he has shared the payment credentials”, the customer bears the entire loss until the transaction is reported, and the bank bears losses after that. A third-party breach reported within three working days carries zero customer liability. In a fake-customer-care case, the caller usually obtains something from you, such as an OTP, which is why the outcome is uncertain, and why reporting within hours matters even when you fear you are at fault. The rules, caps and timelines are laid out in the UPI refund guide and the RBI Ombudsman guide. Do not assume you are out of options because you shared a code; report and let the bank’s investigation decide.

Where each kind of report goes

Chakshu and Sanchar Saathi

The Department of Telecommunications runs the Sanchar Saathi portal and app. A government backgrounder dated 2 December 2025 describes its Chakshu facility as one that “enables users to report suspected fraud communications via calls, SMS, or WhatsApp”, especially KYC-updating scams, and says the same portal lets you check the mobile connections registered in your name and report suspicious ones. The Chakshu link given in a TRAI warning reported by All India Radio on 7 April 2025 is sancharsaathi.gov.in/sfc/. The same report says TRAI “does not initiate communication with customers regarding mobile number disconnection through messages or otherwise” and that confirmed cybercrime victims should call 1930 or use cybercrime.gov.in. A DoT advisory reported on 29 March 2024 said it does not authorise anyone to make calls on its behalf threatening to disconnect mobile numbers. If someone has taken a SIM in your name, the telecom complaint guide explains the next steps.

The DoT has also developed a “Financial Fraud Risk Indicator”, which classifies mobile numbers as medium, high or very high risk of financial fraud for banks, NBFCs and UPI providers to use. That is a tool for the financial institutions, not something you check yourself.

How to find a real customer care number next time

• Open the company’s official website by typing its address, not by clicking a search ad or a map listing, and use the number on its contact page or in its official app.
• Be suspicious of any customer care number written as an ordinary mobile number. RBI’s booklet says genuine customer care numbers are never in that form.
• Never share an OTP, PIN, password or card details with anyone, including someone who says they are from the bank. Never install an app because a caller asks.
• If a company calls you first, hang up and call back on the number from its official website. Check the website legitimacy checklist if you are unsure the site itself is real.

Related: what to do after an investment scam, fake job offer and task scams and online shopping scams.

More in this series on scams and recovery: checking whether a broker or advisor is SEBI-registered and whether a crypto exchange is legal in India.

Frequently asked questions

Is the customer care number that appears on Google always genuine?

No. RBI says contact numbers on internet search engines may be fraudulent and that you should always take contact details from the official website of the bank, NBFC or e-wallet provider. Its booklet adds that genuine customer care numbers are never in the form of mobile numbers.

I shared my OTP or installed a screen-sharing app. What should I do?

Call your bank on its official number and block the card, UPI and account debits, then call 1930 and file at cybercrime.gov.in. Uninstall the app, change your passwords and write to your bank the same day. RBI’s booklet also advises resetting the phone if the fraud came from a data leak on it.

Will my bank refund the money if I gave the caller an OTP?

It is uncertain. Under RBI’s 2017 framework, loss caused by customer negligence, such as sharing payment credentials, falls on the customer until the transaction is reported, and the bank bears later losses. Report at once and let the bank’s investigation decide rather than assuming the answer.

What is Chakshu on Sanchar Saathi?

Chakshu is the Department of Telecommunications facility for reporting suspected fraud communications received by call, SMS or WhatsApp, especially KYC-updating scams. It is at sancharsaathi.gov.in/sfc/. If you have already lost money, call 1930 and use cybercrime.gov.in instead.

Do I report a scam call if I did not lose any money?

Yes, you can. Report the number through Chakshu so the telecom authorities can act on it. Do not call back, do not click links, and block the number. If anything was shared or paid, treat it as a fraud and report to your bank, 1930 and cybercrime.gov.in.

How do I check a bank’s real customer care number?

Type the bank’s own website address into your browser and use the contact details there, or use its official app. Do not use a number from a search result, a map listing, an SMS link or a call you received.