OTP and KYC Tricks in Fake Job Onboarding: How They Work

Last updated: 23 October 2026 · By the Asuraa Team

Quick answer: If an HR person asks you to share an OTP for verification, it is a scam: genuine employers never need OTPs, UPI PINs, passwords or screen-sharing access to onboard you. These codes authorise payments and account access in your name. RBI's BE(A)WARE booklet (March 2022) identifies sharing confidential information as a major cause of financial fraud. If you already shared one, call 1930 and your bank immediately.

Key takeaways

• Genuine HR in India may ask for PAN, Aadhaar-based verification with consent, certificates and a bank account number with IFSC, but never for an OTP, UPI PIN, password, CVV or screen access.
• RBI's BE(A)WARE booklet, released on 7 March 2022, says sharing confidential information knowingly or unknowingly is a major cause of financial fraud.
• Receiving money never requires a UPI PIN; entering a PIN on a 'collect' request sends money out of your account, as the RBI Ombudsman booklet explains.
• UIDAI advises citizens never to share their Aadhaar OTP or m-Aadhaar PIN, to use a VID instead of the Aadhaar number where possible, and to lock biometrics when not in use.
• If you shared an OTP or PIN, call 1930 immediately, then your bank, change passwords and remove any screen-sharing app you installed.

If someone claiming to be HR asks you to read out an OTP "for verification", stop the conversation: no genuine employer in India needs a one-time password, UPI PIN, net banking password or a live view of your phone screen to onboard you. Those codes authorise money and account access. A fake HR who gets them can empty your bank account, take over your apps, or use your identity to open accounts that are later used for fraud. This guide shows exactly what real onboarding asks for, what it never asks for, and what to do if you have already shared something.

Why would fake HR ask for an OTP during "verification"?

Fake HR asks for an OTP because the OTP is the last lock on a transaction or account change they have already started in your name. When you read it out, you approve their payment, login or registration, not a job check. The Reserve Bank of India's BE(A)WARE booklet, released on 7 March 2022, says that customers sharing confidential information, knowingly or unknowingly, is a major cause of financial fraud (RBI press release). The booklet's guidance is blunt: never share an OTP or PIN with anyone, and watch for OTPs you did not request (RBI Ombudsman BE(A)WARE booklet).

A Gujarat Police awareness guide on impersonation fraud lists the fake recruiter or HR as one of the five common impersonation scams and states that legitimate authorities never ask for OTPs or money transfers (Gujarat Police cyber awareness guide).

What does genuine HR onboarding in India actually ask for?

Genuine onboarding asks for identity, education and bank details so that you can be paid and verified, but it never asks for the codes that unlock those accounts. Typical requests from a real employer include your PAN, an Aadhaar copy or Aadhaar-based verification with your consent, education certificates and mark sheets, previous employment documents if any, a bank account number and IFSC for salary, and consent for a background check. Our guide to the background verification process in India explains what the checks involve, and the first-job guide from offer to joining covers the normal paperwork in order.

The difference is between information that identifies you and information that authorises actions. Sharing your account number lets an employer pay you. Sharing your OTP, PIN or password lets someone act as you.

Which requests does real HR never make, and why?

Real HR never asks for anything that would let them move your money, log in as you or control your device. Use this table as a checklist.

The screen-sharing apps named above come from IDFC FIRST Bank's fraud advisory, which warns customers not to install remote-access apps at anyone's request (IDFC FIRST Bank). The UIDAI rules come from its citizen advisory, which also says not to share your m-Aadhaar PIN (UIDAI advisory via Vikaspedia).

How does the OTP and KYC trick usually unfold?

The trick usually unfolds in four or five quick steps that feel like normal onboarding until the moment an authorising code is requested. A common pattern looks like this:

1. A fast "selection". You get a call, WhatsApp or email saying you are shortlisted, often after a short chat interview or no interview at all.
2. A document request. "HR" asks for PAN, Aadhaar, a photo and a bank passbook on WhatsApp. These look routine, so most people send them.
3. The verification step. You are told a code will arrive "from our verification partner" and asked to read it back, approve a UPI request, or install an app "for e-KYC".
4. The pressure. "Your offer will be cancelled in 10 minutes" or "the portal is closing today" pushes you to act without thinking.
5. The aftermath. Money leaves your account, your accounts are taken over, or your documents are used to open new accounts and SIMs.

The Gujarat Police guide specifically warns that KYC documents collected by fake recruiters can be used to open accounts in the victim's name (Gujarat Police). This matters because of mule accounts: according to a July 2025 government reply in Parliament, a first-layer mule account is created either with stolen Aadhaar and PAN details or by luring people to rent out their accounts (Scroll). See our explainer on money mule job offers for how that ends.

What do most guides on OTP and KYC job scams get wrong?

Most guides say "never share your documents with anyone", which is unrealistic advice for someone who has a genuine offer and must complete background verification. The useful rule is narrower and stricter. Identity documents can go to a verified employer through an official channel, such as a company email domain or HR portal you reached yourself. Authorising secrets, meaning OTPs, PINs, passwords, CVVs and screen access, go to nobody, including a real employer.

A second gap: many guides talk only about bank OTPs. In practice, any code that arrives on your phone can authorise something, whether it is for Aadhaar, a payment app, an email account or a messaging app. If you did not start the action yourself, the code is not yours to share. A third gap is the assumption that you are safe if you never paid anything. Documents you sent may still be misused weeks later, which is why the recovery steps below include checking accounts and SIMs in your name.

For more on spotting impostors before you reach this stage, read our guide to fake HR call and email scams and how to check if an offer letter is fake.

How can I verify that the HR person is real?

Verify the HR person through a channel you find yourself, not through any number, link or email they sent you. Practical steps:

1. Check the email domain. A real offer usually comes from the company's own domain, not a free webmail address.
2. Call the company's official number from its official website and ask whether the recruiter and the role exist.
3. Look up the recruiter on LinkedIn and confirm they list the company as their current employer, with a history that makes sense.
4. Ask for the onboarding portal link by email and open the company's site separately to confirm it.
5. Refuse any step that needs an OTP, PIN, password or app install, however polite or urgent the request.

What should I do if I already shared an OTP, PIN or my documents?

Act within minutes: call the national cybercrime helpline 1930, then your bank, and change your passwords. The Gujarat Police guide notes that recovery chances are best when 1930 is called immediately (Gujarat Police).

1. Call 1930 and report the transaction details, then file a complaint on cybercrime.gov.in.
2. Call your bank's official helpline to block cards, UPI and net banking if needed.
3. Change passwords and UPI PINs for banking and email, and log out of other devices.
4. Uninstall any screen-sharing app you installed at their request.
5. Lock your Aadhaar biometrics and check your Aadhaar authentication history on UIDAI's site or the m-Aadhaar app. UIDAI's helpline is 1947 (UIDAI advisory).
6. Check mobile numbers registered in your name on Sanchar Saathi, as the Gujarat Police guide recommends, and report the fraudulent call or message through Chakshu on Sanchar Saathi (HDFC Bank notice on Chakshu).
7. Keep evidence: screenshots, numbers, emails and transaction IDs.

Our guide on how to report a job scam in India walks through the complaint form.

Why does this matter even if no money was lost?

It matters because your identity can be used to open accounts that move other people's money, and the account holder is the one investigators reach first. Outlook Money, citing a Ministry of Finance statement of March 2026, reports that I4C flagged over 2.73 million suspected mule accounts between September 2024 and early 2026 (Outlook Money). Protecting your KYC is part of protecting your record. The wider picture of these frauds is in our complete guide to job scams in India.

Related guides

• Job Scams in India: How to Spot, Verify and Report Them
• 'Data Entry Job in Thailand': The Scam Compound Trap Explained
• Part-Time Job That Became a Crypto 'Investment'? The Pattern
• Fake Overseas Job Offers: How Indians Can Check Before Paying

FAQ

Is it safe to share an OTP with HR for verification?

No. A genuine employer verifies you through documents and official background checks, not through codes sent to your phone. An OTP authorises a payment, login or account change that someone else has started in your name. RBI's fraud awareness booklet tells people never to share an OTP or PIN with anyone, whoever they claim to be.

Why would HR ask for my UPI PIN to send a joining bonus?

Because the 'bonus' is really a collect request that takes money from you. The RBI Ombudsman's BE(A)WARE booklet explains that receiving money never requires a PIN; if an app asks for your PIN, you are paying. Real salary or reimbursement is credited using only your account number and IFSC.

Does a real company ask me to install AnyDesk or TeamViewer during onboarding?

No. Real onboarding happens through the company's own HR portal or email. Screen-sharing apps let the other person watch or control your phone while you open banking apps. Banks such as IDFC FIRST Bank warn customers never to install apps like AnyDesk, TeamViewer QuickSupport or AirDroid at someone else's request.

Which documents can I safely give a new employer?

After you have verified the employer through its official website or email domain, it is normal to share PAN, certificates, an Aadhaar copy or Aadhaar-based verification with consent, and your bank account number with IFSC for salary. Share them through the official HR channel, not a random WhatsApp number, and never add OTPs, PINs or passwords.

What should I do if I gave my Aadhaar and PAN to a fake recruiter?

Lock your Aadhaar biometrics and check your authentication history through UIDAI, call UIDAI on 1947 if you see misuse, check the mobile numbers registered in your name on Sanchar Saathi, watch your bank statements, and report the recruiter on cybercrime.gov.in or 1930. Misused documents can be used to open accounts in your name.

Where do I report a fake HR who asked for my OTP?

If money was taken, call 1930 at once and file a complaint on cybercrime.gov.in. If no money was lost, you can still report the number or message through Chakshu on the Sanchar Saathi portal, inform the real company whose name was misused, and report the profile on LinkedIn or the job site where it appeared.

Final thoughts

A real job offer survives every check you make, and it never depends on a code from your phone. Keep your OTPs, PINs and screen to yourself, verify HR through channels you find independently, and apply through listings you can check, such as those on Asuraa's job search.