The Message From "Bank Manager Uncle"

It was a quiet Tuesday night, and Ranjan uncle was alone in his living room, finishing his tea, when his phone buzzed. A message. He picked it up and read it twice, and the second time his stomach dropped a little.

"Dear Customer, your SBI KYC will EXPIRE TODAY. Update immediately or your account will be BLOCKED within 2 hours. Click now to verify: sbi-kyc-verify-online.in"

Ranjan uncle was not a man who liked surprises, and he liked the word "blocked" even less. His whole pension came into that account. He sat up straight, found his glasses, and started typing the link into his phone.

Just then, the doorbell rang. Bunny had come to drop off the new society chore register, with Riya trailing behind him to collect a book she'd lent Ranjan uncle weeks ago. They found him hunched over his phone, thumb hovering, looking pale.

"Uncle, what's wrong?" asked Bunny.

Ranjan uncle showed them the message. Riya read it once and frowned. "Who's it from?" she asked, and tapped the sender name. It wasn't a saved contact. It wasn't even a bank's usual short code. It said, simply, VM-SBIKYC.

"That's not how the real bank sends messages," said Bunny slowly. "And look at this link. It says sbi, but it's not actually the bank's website. It's a completely different address that just looks similar."

Ranjan uncle looked at the clock. 11:47 PM. "But it says two hours," he said, his thumb still hovering over the link. "What if it's real?"

Before anyone could answer, the phone rang. Ranjan uncle answered it, hands shaking slightly, and put it on speaker so the kids could hear too.

"Namaste sir," said a smooth, friendly voice. "Main aapke bank se bol raha hoon, aap mujhe Bank Manager Uncle bol sakte hain. Aapka KYC turant update karna hai, warna account block ho jayega. Bas ek chhota sa OTP bata dijiye, sir, bas do minute ka kaam hai."

The voice was patient and polite and called him sir again and again, the way a man who truly respected him would. "Please sir, time kam hai," it added. "Aapka OTP aane wala hai, jaise hi aaye, bol dijiye."

Ranjan uncle, who had spent a lifetime believing that polite people were trustworthy people, began to nod along. "Haan, theek hai," he started to say.

Right then, an SMS landed on the phone, sitting face up on the table. "Your OTP is 7294. Do not share this with anyone, including bank staff." Mitthu, who had flown in through the balcony door a minute earlier and perched himself right next to the phone, tilted his head, read it, and opened his beak out of pure habit.

"Seven! Two! Nine," he began, exactly the way he'd read Mrs. Iyer's password out loud a week ago.

And then he stopped. Just like that, mid-word, as if something had clicked. He closed his beak, ruffled his feathers, and said instead, very primly, "Can't tell you. Private information."

Bunny didn't wait to see if the moment would last. He lunged for the phone and ended the call, right in the middle of "Sir, bataiye".

The living room went quiet. Ranjan uncle stared at the blank screen, then at Mitthu, then at Bunny. "Did I almost..." he started.

"Yes," said Riya gently. "You almost did."

Bunny called Nilu chachu, who arrived within the hour, still in his kurta, carrying his laptop out of habit. He read the message, listened to Ranjan uncle describe the call, and nodded slowly.

"This is called phishing," he said. "Spelled with a ph, as a little joke on the word fishing. Someone casts out a message to thousands of phones at once, baits it with fear or urgency, and waits for a few people to bite. The phone call is the same trick with a human voice attached, and that one even has its own name: social engineering. It means tricking a person directly, instead of tricking a computer."

"But he sounded so sure," said Ranjan uncle. "He even called it correctly, Bank Manager."

"Of course he did," said Nilu chachu. "He can call himself anything he likes. A caller ID can even be faked to show a bank's real name, a trick called spoofing. None of that is proof of anything. Here's the one rule that never changes: a real bank, a real government office, a real anyone, will never, ever ask you to tell them your OTP over a call or a message. An OTP exists so that only you can approve something, using your own phone, in your own banking app. The moment someone else asks for it, the whole idea has already failed."

"Then what should I have done?" asked Ranjan uncle.

"Hung up," said chachu. "And if you were ever unsure, called the number printed on the back of your own card, not any number from the message. Never the one they give you. Always the one you already trust."

Together, they blocked the number, and Nilu chachu showed Ranjan uncle how to report the message through Chakshu on the Sanchar Saathi portal, sancharsaathi.gov.in. He also told him about 1930, India's cybercrime helpline, and cybercrime.gov.in, for whenever money has actually been sent.

Then Ranjan uncle, in a move that surprised everyone a little, opened the Silverline Heights WhatsApp group and typed, slowly and with great care, a warning to the whole building. He read it aloud before sending, the way he always did. "Do not share it anywhere it can be seen," he murmured, and then laughed at himself for saying it, because that was exactly the lesson from last time too.

Later that night, Ranjan uncle sat on the balcony with a fresh cup of tea, Mitthu perched companionably on the railing beside him.

"You caught yourself," Ranjan uncle said to the parrot. "Last week you'd have read that whole number out before anyone could stop you."

Mitthu considered this with great dignity. "I am a quick learner," he said, "for a parrot who nearly wasn't."

Ranjan uncle laughed, properly, for the first time all evening.