Am I liable if I share OTP by mistake?

Banks have liability if they fail to protect your account. Report within 3 days to bank for full reversal under RBI circular.

If you shared your OTP due to a social engineering fraud (someone posing as a bank official, delivery executive, etc.), the RBI Circular on Limiting Liability of Customers (2017) provides protection. If you report the unauthorized transaction within 3 working days, you have zero liability and the bank must reverse the amount. If reported within 4-7 days, your liability is limited to a maximum of Rs. 25,000. Beyond 7 days, liability is as per bank policy. The bank must credit the disputed amount within 10 working days of receiving your complaint and complete investigation within 90 days. File complaint with: (1) Bank's customer care, (2) Bank's Nodal Officer, (3) RBI Ombudsman at cms.rbi.org.in if unresolved. Also file cybercrime complaint under IT Act Section 66C (Identity theft) and 66D (Cheating by personation).

• RBI Circular on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (2017)
• IT Act — Section 66C (Identity theft) / Section 66D (Cheating by personation)
• Consumer Protection Act 2019