Your Banking Credentials: PIN, OTP and Why Neither Is Ever Shared
A personal identification number (PIN) and a one-time password (OTP) are not passwords. Neither says who the holder is. Each says that whoever holds this card or this phone approved this particular payment. The bank sends the code and checks the PIN, so a bank never asks for either. And a code read out to somebody turns an unwanted payment into an approved payment on the record.
A code may already have left the house an hour ago, so one thing needs saying first. Sharing a code is not carelessness. The request is built to arrive inside a situation genuinely happening to the household, at the moment when six digits are the fastest way to end something unpleasant. People who work inside banks share codes.
One distinction carries everything. A password proves who the holder is. A PIN and a one-time password prove that the holder agreed to this. Mixing the two up is what makes a shared code feel survivable.
What does a password prove, and what does a PIN prove instead?
A gate makes the point. A watchman can ask who a resident is, and a card with a photograph on it settles that. Or he can ask whether the resident agreed to let this delivery upstairs, and no card answers that: he has to hear it from the resident, now, about this delivery.
The first question is authenticationProving to a system who the holder is., and a password answers it. The second is authorisationProving that the holder approved a particular action., and a PINA short number entered to approve a payment or a withdrawal. answers it. A password answers who is this. A PIN answers was this approved. A password is a standing key, and changing it shuts the door behind whoever learned it. Agreement is an event, and nothing undoes it afterwards.
What does a PIN prove that a password does not?
Where is a PIN actually checked, and by whom?
A PIN is a short number, usually four digits or six, and the length is set by whoever issued the card. Where the number goes matters far more. Not to the shopkeeper, not to the person holding the machine, and not into the machine. The PIN travels, scrambled, to the system that issued the card.
A PIN is checked by machinery against something the issuer already holds, so at no point in an ordinary payment does any human being need to know it. Not the shopkeeper, not the counter staff, not anyone at the bank. No legitimate step anywhere has a PIN spoken, written on a form or repeated back.
At the instant it is entered, a PIN is not proving that the person at the machine is Meghna Bhosale. The entry proves that whoever is at this machine, with this card, for this amount, agreed. The machinery never asked who was answering. To the machinery, a lost card with a known PIN is a complete transaction.
One mechanical rule sits underneath all of it. Entering a payment PIN sends money out. A payment PIN never brings money in and never confirms a refund. A screen asking for a payment PIN in order to receive money is asking for something no payment system does.
What is a one-time password, and why does it expire?
A one-time passwordA code sent for a single transaction, valid for a few minutes only. is a short code the bank creates for one transaction and sends to the registered numberThe telephone number the bank holds and sends codes to. on the account. Type it once and it is spent, and if it is not typed within minutes it dies whether anybody used it or not.
The journey is short and has one honest ending. The bank makes the code, sends it to the number it holds, the account holder types it into the screen in front of them, and the bank checks it against what it made moments earlier. No step in that chain has a person hearing the code.
Now the expiryThe point at which a code stops working, usually within minutes.. People read the expiry as a nuisance. The expiry is the point of the whole thing. A password is useful because it lasts. A code is useful because it does not. If a code lasted, agreement could be stored up and spent later.
The message carries the sentence that nobody reads. The message already carries the amount, who is being paid, how long the code lives and a line saying the bank will never ask for it. A code message describes the payment completely, so reading it is the same act as reading the payment.
Why can a bank never need either of them?
The bank made the code. The code existed inside the bank before it existed on the account holder's phone, so a request to read it back would be a request to tell the bank something it generated thirty seconds earlier. The PIN is the same argument from the other end: nobody at a bank reads one.
The rule that a bank never asks for a code is not a policy that could change next year; it describes how the mechanism is built. So anybody asking for a code is asking for the one thing that has no legitimate use in their hands, whatever else they know about the account holder.
Somebody who knows the account balance and the last transaction asks for a code. What does knowing those details prove?
What changes on the bank record when a code is used?
The next part is invisible, and invisible things are hard. A payment before a code is an instruction that nothing has approved. The moment a valid code is entered, that same payment carries an approval against it. A code does not move money; it changes what a payment is on the record, and money then follows a record that says approved.
Why does that matter more than the money? Because everything afterwards starts from what the record says. A disputeA formal claim that a transaction was not approved by the account holder. against a payment the record calls unapproved and one against a payment it calls approved are different conversations from the first sentence. Who decides is set out by the Reserve Bank of India at rbi.org.in.
A code is shared. Before the control below is touched: what changes first, the money or the record?
Move a payment along its life and watch the record, with the code shared and without it.
One invented payment of Rs 22,000/- is pushed out of the Bhosale household salary account on 30 April, when that account held Rs 4,030/-. The slider moves it through the five points of its life; the buttons say whether a code was read out. The panel opens at the second point with the code shared: the record reads authorised while the balance is still Rs 4,030/-. One point on it falls to minus Rs 17,970/-.
The readings run like this. At the opening position the record reads authorised while the balance is still Rs 4,030/-. One point on, it still reads authorised and the balance drops to minus Rs 17,970/-. Press the second button and the status reads not authorised everywhere. Every difference between the two runs is six digits.
What did this look like in the Bhosale household on one day?
Meghna Bhosale is salaried at Sahyadri Freight Services Private Limited and her take-home pay of Rs 39,800/- lands on the 1st. Ashok Bhosale runs a tailoring counter whose takings go into the same account. All of it sits behind two things: a four digit number and a six digit code.
April had been hard for reasons that had nothing to do with anybody being careless. By 24 April the salary account stood at minus Rs 3,170/-, after Rs 4,000/- had already been moved across from the buffer savings. The account stayed below zero for six days, and the charge came to Rs 304/-: interest Rs 9/-, a usage fee Rs 250/- and tax Rs 45/-.
Then the telephone rang. The caller said the account had gone below zero. The account had. The caller named the charge of Rs 304/-, and that figure was right. The caller said it could be reversed, and asked for a code. Every part of that call was true except the last, and the last was the only part the call existed for.
Nobody read the code out, and the honest reason is not a flattering one. Alertness had nothing to do with it. The person answering was worried about money, and worried people are not alert. The stop came from a sentence written on a cupboard door months earlier, when nobody was worried about anything.
What shapes does the request take, and what do they all have in common?
The requests do not look alike. Trying to recognise them is therefore the wrong strategy. First, a call about a charge, of the kind the Bhosale household met. The fee is real, and somebody offers to make it go away. A message about a delivery that really is coming. A screen about a refund that really is owed, asking for a payment PIN to send it. A person with a form.
All four arrive at somebody asking for a code, a PIN or control of the screen, so the four shapes differ endlessly on the surface and are identical at the end. The task is not to spot four beginnings. The task is to notice one ending.
Four requests arrive in four completely different forms. What do they have in common?
The belief that a careful person cannot be caught
The belief that a careful person cannot be caught is the most damaging idea in the subject, and it is held almost everywhere, including by people who have already shared a code. The belief stops people preparing, and afterwards it turns an ordinary event into a private shame that keeps people from telephoning the bank in the first minutes.
The belief assumes the request arrives standing alone, at a moment of the household's own choosing. A request never does. A request arrives inside a situation genuinely happening to that household, and the details are real because real details are obtainable.
Somebody who shares a code under those conditions has not been careless; they have been placed inside a situation built so that sharing would feel like the sensible thing to do. That is not the sentence people say to themselves afterwards, and it is the true one.
Which is why a rule fixed in advance works where being careful does not. Being careful is a state a person has to be in. A rule is already decided, by a calmer version of the same person, and applying it does not require calm.
Why is a rule fixed in advance better than being careful in the moment?
What else counts as a credential, and what is only a label?
A credentialSomething that proves either who the holder is or that the holder approved something. is anything that, once handed over, lets somebody else act as the account holder. Being able to act as the account holder is the test. Everything else about an account is a label, and labels exist to be given out.
Credentials, then. A card PIN. The PIN inside a payment application. A one-time code. The three digits on the back of a card. A net banking password. The approval tapped when a request appears. And control of the screen. An application that lets somebody else operate the phone hands over everything at once.
An account number is not a credential. Neither is the branch code, a name, an address or a telephone number. A credential lets somebody act as the account holder. A label only points at the account holder, and that is why account numbers are printed on cheques without anybody thinking twice.
Is a bank account number a credential?
Who actually asks a household for what, as part of a real job?
A bank service desk is working out whether it is speaking to the account holder, so it asks things that identify: a name, a date of birth, an address it already holds, a recent transaction amount. The questions have one thing in common. Each points at the account holder, and none of them can move a rupee.
A merchant needs the amount and afterwards a reference number. A lender wants statements and payslips. An insurer wants policy documents. Every role that touches a household money in the ordinary course of business is built to work without ever knowing a PIN or a code.
One genuine confusion deserves naming. A delivery agent may ask for a code, and that code is often perfectly real: it confirms a parcel was handed over. The delivery code did not come from the bank. A code naming an amount and an account is a banking credential. A code naming a parcel is not.
A code has just been shared. What matters most in the next few minutes?
What should happen in the first few minutes afterwards?
Speed, and not understanding. Putting speed first goes against instinct. Instinct says work out what happened, and how anybody could have been so foolish. Neither is urgent, and the second is not even true.
The steps are short. The bank is telephoned on a number taken from the card itself, from the passbook or from the application already installed, never a number given during the conversation. The account or card is blocked, the time and what was said are written down, and a reference number is asked for.
Blocking an account can only be done now, and working out what happened can be done at any point afterwards, so reporting comes first and understanding second. It is a matter of which task has a clock on it.
Telling somebody in the household the same evening is worth doing even though it is the hardest part, and a household that has agreed in advance that this happens to anybody has taken most of the sting out of that conversation already.
Where the reporting route and the customer protection position are set
Everything above about identity, agreement and what a code establishes holds anywhere. The route after a report does not. In India the customer protection framework for unauthorised electronic banking transactions, the complaint route and the ombudsman arrangement behind it are matters for the Reserve Bank of India at rbi.org.in.
How each payment rail works and how a completed payment is traced are described by the National Payments Corporation of India at npci.org.in. Each bank publishes its own reporting numbers, printed on the card, the passbook or the application.
What can a household put in place beforehand that costs nothing?
One written sentence, agreed by everybody who lives there. Not a system, not an application. A sentence, in the language the household actually speaks, somewhere everybody sees it: nobody here reads out a code or a PIN, to anybody, for any reason, ever.
Read the shape of that sentence. The shape does the work. The sentence contains no judgement to make, and a rule with no conditions cannot be argued out of somebody by a person who is good at arguing. A rule fixed in advance survives the moment because it does not have to be applied by somebody who is calm.
People lack permission, not knowledge. A second sentence supplies it: nobody here has to stay on a call about money. Most people know the rule about codes already, and what stops them acting on it is that ending a conversation feels impolite.
And make it cover everybody, including a child old enough to answer the telephone and an elderly parent at home during the day. Whoever answers is rarely whoever read about this.
What costs a household nothing at all and works better than staying vigilant?
References
| Source | Document | Where |
|---|---|---|
| Reserve Bank of India | Customer protection material on unauthorised electronic banking transactions and the grievance and ombudsman route, named for the existence of that framework only. No timeframe, limit or liability position is reproduced here | rbi.org.in |
| National Payments Corporation of India | Material on how each payment rail settles and on the reference a completed payment leaves behind, named for the existence of that reference only | npci.org.in |
| Reserve Bank of India | Customer awareness material on banking credentials and the standing position that a bank does not ask a customer for a code or a PIN, named for the existence of that position only | rbi.org.in |
The Bhosale household, Meghna Bhosale, Ashok Bhosale, Ira Bhosale, Sahyadri Freight Services Private Limited and every amount here, including the payment of Rs 22,000/-, the balances of Rs 4,030/- and minus Rs 17,970/- and the charge of Rs 304/-, are invented.
Educational material. Not advice on any investment, tax, budget or market position.