I accidentally shared my OTP with a scammer, am I liable for the loss?

I gave my OTP to someone posing as a bank official and now money is missing from my account. I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

I accidentally shared my OTP with a scammer, am I liable for the loss? is governed in India primarily by RBI Circular on Customer Liability in Unauthorised Electronic Transactions, 2017, Information Technology Act, 2000 – Section 66D and Indian Contract Act, 1872 – Section 23. The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

Sharing an OTP under deception is still treated as an 'unauthorised transaction' for RBI liability purposes because you were induced by fraud, not negligence in the legal sense of voluntarily authorising a payment.

Banks often initially deny refunds by calling this 'customer negligence', but courts and the Banking Ombudsman have repeatedly held that phishing-induced OTP disclosure falls under third-party breach, not customer fault, if reported promptly.

Section 66D IT Act criminalises the caller for cheating by personation, and your complaint helps build the criminal case even if the civil refund takes longer.

Timely reporting within 3 working days is critical — it shifts the burden and caps your liability at zero under the RBI framework.

If the bank refuses to refund without valid reason, you can approach the RBI Integrated Ombudsman Scheme, 2021 free of cost.

What to do next: 1) Report to your bank in writing within hours, quoting the RBI 2017 circular; 2) File a complaint at cybercrime.gov.in or call 1930; 3) Ask the bank for a copy of its investigation report if the refund is denied; 4) Escalate to the RBI Ombudsman if no resolution in 30 days.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under RBI Circular on Customer Liability in Unauthorised Electronic Transactions, 2017 carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.

Disclaimer: This information is for general awareness and does not constitute legal advice. Statutes and their interpretation change, and outcomes depend on the facts of your case. Please consult a qualified advocate before acting on it.