How scammers use credit card limit upgrades to steal money with one OTP

Representative image

Banks do raise limits, but scammers copy the script. They call or text saying you qualify for a higher limit and push you to share an OTP “to confirm.” That OTP often approves a new device, adds a beneficiary, or completes a card-not-present purchase. Once you read it out, your money can move in seconds.

The caller already has your name and the last four digits of your card, so it sounds legit. They send an OTP while you’re on the call and claim it’s needed for the upgrade. In reality, the OTP is for a risky action—linking your card to a wallet, enabling UPI on a new phone, or approving a transaction. Sometimes they also push you to install a screen-sharing app.

Any “upgrade” you didn’t request is suspect. Banks don’t need your PIN, CVV or OTP to inform you of eligibility. Pressure to act “right now,” links from private numbers, or requests to install apps are classic warning signs. If the message says “do not share OTP,” treat the call as a scam the moment they ask for it.

Hang up, open your bank’s official app or website, and check for offers there. Call the number on the back of your card—not the one in the SMS. If there is a genuine offer, you can accept it safely inside the app without telling anyone an OTP.

Act immediately. Block or hotlist the card in your app, change app and email passwords, and call customer care to freeze suspicious channels (international, contactless, online). Raise a complaint, then file a cybercrime report at 1930 or cybercrime.gov.in and note the ticket number. Faster action improves recovery chances.

Turn on real-time alerts for every rupee moved. Set low per-transaction limits and keep international/online usage off until needed. Lock the card when you’re not using it. Never store card photos or OTP screenshots in your gallery or chat.

If you change phones or SIMs, re-verify all banking apps and kill old device access.

A real bank will never ask for your OTP, PIN, or CVV over a call or SMS. If someone needs an OTP to “upgrade” your limit, they’re upgrading their chances—not yours. Verify inside the official app and keep tight controls so one mistake doesn’t empty your account.