{"id":13362,"date":"2026-04-22T17:42:22","date_gmt":"2026-04-22T17:42:22","guid":{"rendered":"https:\/\/srv1603485.hstgr.cloud\/remote-access-apps-bank-account-threat\/"},"modified":"2026-09-24T12:05:33","modified_gmt":"2026-09-24T12:05:33","slug":"remote-access-apps-bank-account-threat","status":"publish","type":"post","link":"https:\/\/www.billcut.com\/blogs\/remote-access-apps-bank-account-threat\/","title":{"rendered":"Remote Access Apps: Quiet Threat to Bank Accounts"},"content":{"rendered":"

By BillCut<\/strong>
Last updated: September 2026<\/p>\n

If money left your account after someone got you to install screen sharing software, that is an unauthorised electronic banking transaction. Tell your bank within three working days and your liability can be zero. The clock, not the police complaint, is the thing that decides what you lose.<\/p>\n

Most pages on this subject explain how the scam works and stop there. The part that changes the outcome is what you do in the next few hours.<\/p>\n

Why the First Three Working Days Decide What You Lose<\/h2>\n

Your liability is capped by how fast you report, and the caps are set by the regulator rather than by your bank.<\/p>\n

Under the Reserve Bank of India circular on limiting the liability of customers in unauthorised electronic banking transactions, dated 6 July 2017<\/a>, a customer bears zero liability where the loss arises from contributory fraud, negligence or deficiency on the part of the bank, whether or not the customer reported it. Zero liability also applies where the fault lies elsewhere in the system and the customer notifies the bank within three working days of receiving the bank\u2019s communication about the transaction.<\/p>\n\n\n\n\n\n\n
When you notify the bank<\/th>\nWhat you can be held liable for<\/th>\nOn an illustrative Rs 50,000 loss<\/th>\n<\/tr>\n
Within 3 working days<\/td>\nNothing<\/td>\nRs 0<\/td>\n<\/tr>\n
4 to 7 working days<\/td>\nThe transaction value or the capped amount for your account type, whichever is lower<\/td>\nRs 10,000 on a savings account<\/td>\n<\/tr>\n
Beyond 7 working days<\/td>\nDetermined by the bank\u2019s board approved policy<\/td>\nPotentially the full Rs 50,000<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The caps in the middle row are specific. For a basic savings bank deposit account the maximum is Rs 5,000. For a savings account, a prepaid instrument, a gift card, an individual current, cash credit or overdraft account up to Rs 25 lakh, or a credit card up to Rs 5 lakh, it is Rs 10,000. For other current, cash credit and overdraft accounts and credit cards above Rs 5 lakh, it is Rs 25,000.<\/p>\n

Read the middle row once more. Moving from the third working day to the fourth can cost you Rs 10,000 on an ordinary savings account, and that is true whether the amount taken was Rs 12,000 or Rs 12 lakh.<\/p>\n

What Do You Do in the First Hour?<\/h2>\n

In this order, and the first two matter more than the rest.<\/p>\n

    \n
  1. Disconnect the device from the internet. Turn off mobile data and Wi-Fi. This ends the session immediately, which matters because access continues after the call does.<\/li>\n
  2. Call your bank and report an unauthorised transaction, in those words. Banks are required to provide reporting access 24 hours a day through multiple channels, at a minimum a website, phone banking, text message, email, an interactive voice system, a dedicated toll free helpline and your home branch. Note the time of the call and the reference number.<\/li>\n
  3. Ask the bank to block the card and the account for further debits. Report every transaction you can see, not only the largest one.<\/li>\n
  4. Uninstall the software and remove its permissions, particularly anything under accessibility. Do this after the first two steps, not before, because the report is more urgent than the cleanup.<\/li>\n
  5. Call the national cyber crime helpline on 1930 and register a complaint on the National Cyber Crime Reporting Portal the same day. The Press Information Bureau release of 18 December 2024<\/a> records that the toll free helpline 1930 was introduced in 2020 to support victims of cyber crime, alongside the portal for reporting incidents.<\/li>\n
  6. Report the number that contacted you. The Department of Telecommunications runs Chakshu on the Sanchar Saathi portal<\/a>, which lets citizens report suspected fraud communication intended to defraud telecom users, whether it arrived by call, text message or WhatsApp.<\/li>\n<\/ol>\n

    Do not wait for the police complaint before telling the bank. They are separate processes on separate clocks, and only one of them caps your liability.<\/p>\n

    What Does Reporting Late Actually Cost?<\/h2>\n

    The figures below are illustrative and use the caps set out above. Assume Rs 50,000 taken from an ordinary savings account.<\/p>\n\n\n\n\n\n\n
    Scenario<\/th>\nYou bear<\/th>\nWhat made the difference<\/th>\n<\/tr>\n
    You call the bank the same evening<\/td>\nRs 0<\/td>\nInside the three working day window<\/td>\n<\/tr>\n
    You wait for the police complaint first and call on day five<\/td>\nRs 10,000<\/td>\nTwo days of delay, at the savings account cap<\/td>\n<\/tr>\n
    You assume nothing can be done and call after a fortnight<\/td>\nUp to Rs 50,000<\/td>\nOutside the capped window entirely<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    The gap between the first and second rows is Rs 10,000 for two days. The gap between the first and third is the whole amount. Nothing about the fraud changed across those three scenarios. Only the reporting date did.<\/p>\n

    That is also why the advice to change your passwords first is the wrong order. Changing a password is useful. It does not start any clock.<\/p>\n

    If a loss like this has already landed on a credit card, the interest on it runs whether or not the complaint is resolved. BillCut is a debt refinancing platform and therefore has a commercial interest in this category. You can see how BillCut approaches credit card balances<\/a> separately from the fraud complaint itself.<\/p>\n

    Who Has to Prove What, and What If the Bank Refuses?<\/h2>\n

    The burden is not on you. The circular states that the burden of proving customer liability in a case of an unauthorised electronic banking transaction lies on the bank.<\/p>\n

    That matters because the most common pushback a victim hears is that they authorised it themselves by approving something on screen. Where the transaction is disputed, it is for the bank to establish the customer\u2019s liability, not for the customer to prove innocence.<\/p>\n

    Keep a written record from the first hour: the time you called, the reference number, the numbers that contacted you, screenshots of the transactions, and the complaint acknowledgement from the cyber crime portal. Written records are what turn a disputed account of a phone call into evidence.<\/p>\n

    If the bank does not resolve it, the escalation route is the Reserve Bank Integrated Ombudsman Scheme, introduced on 12 November 2021<\/a>, through the Complaints Management System portal at cms.rbi.org.in, with a contact centre on 14448. Take the reference numbers with you.<\/p>\n

    What Is a Screen Sharing Scam, and How Does the Money Move?<\/h2>\n

    A screen sharing scam is one where someone persuades you to install software that lets them see and control your phone or computer, then uses that access while you are still on the call.<\/p>\n

    The software itself is ordinary. Screen sharing and remote support tools are normal products used legitimately by technical support teams every day, and there is nothing wrong with the category. The fraud is entirely in who is asking you to install it and why.<\/p>\n

    Once the session is live, the person on the other end can see everything on the screen, including your banking app and any one time password that arrives as a notification. They do not need to ask you to read a code aloud, which is why the usual advice about never sharing an OTP does not protect you here. The habits that do still matter are covered in this piece on OTP sharing mistakes you do not realise you make<\/a>.<\/p>\n

    Two things surprise people afterwards. Access usually continues after the call ends, unless the session is closed or the connection is cut. And the transactions are often several small ones rather than one large one, because smaller amounts attract less scrutiny and are easier to miss on a statement.<\/p>\n

    How Does a Screen Sharing Scam Start?<\/h2>\n

    With a reason to install something, delivered by someone who sounds like they are helping.<\/p>\n\n\n\n\n\n\n\n\n
    What you are told<\/th>\nWhat is actually being asked<\/th>\nWhat a genuine process looks like<\/th>\n<\/tr>\n
    Your account will be blocked unless it is verified now<\/td>\nInstall software so the verification can be done for you<\/td>\nA bank asks you to visit a branch or use its own app, never a third party tool<\/td>\n<\/tr>\n
    A refund or cashback needs to be processed<\/td>\nGive access so the amount can be credited<\/td>\nRefunds arrive without you installing anything or approving a debit<\/td>\n<\/tr>\n
    Your loan application needs help being completed<\/td>\nScreen access to fill the form together<\/td>\nA lender sends a link to its own application, and never needs to see your banking app<\/td>\n<\/tr>\n
    A delivery or utility payment failed and must be retried<\/td>\nAccess to correct the payment<\/td>\nA failed payment is retried by you, in the app it failed in<\/td>\n<\/tr>\n
    Technical support noticed a problem with your phone<\/td>\nRemote control to fix it<\/td>\nNobody legitimate calls you first about a problem you have not reported<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    The single reliable rule sits in that middle column. No bank, lender, wallet or payment company needs to watch your screen to help you, and none will ask you to install a third party tool to receive money. If money is supposed to be coming to you, nothing needs to be installed and nothing needs to be approved.<\/p>\n

    The same instinct applies to what apps you let onto the phone in the first place, which is the subject of this guide to instant loan app permissions and what to avoid<\/a>.<\/p>\n

    How Do You Stop It Happening Again?<\/h2>\n

    Three changes do most of the work, and none of them requires any technical skill.<\/p>\n

    Check what has accessibility permission on your phone and turn off anything you do not recognise. That permission is what lets software read and control other apps, and it is the one that makes this fraud possible rather than merely inconvenient.<\/p>\n

    Turn on transaction alerts for every account and actually read them. A small debit noticed the same evening is inside the three working day window. The same debit noticed on a monthly statement is not.<\/p>\n

    Agree one rule with the people in your household who are most likely to be called, which is usually older relatives and anyone new to digital banking. The rule is that nothing gets installed during a phone call, ever, regardless of who the caller says they are. It is easier to follow than a list of warning signs because it requires no judgement in the moment.<\/p>\n

    One thing worth adding. If a number has already been used against you, you can check identifiers before dealing with anyone again. The Report and Search Suspect facility on the National Cyber Crime Reporting Portal<\/a> lets you search mobile numbers, email addresses, account numbers and website addresses for possible linkages with cyber criminals, and report the ones used against you. A clean result only means nothing has been reported yet, so treat it as one signal rather than a clearance. Where the fraud arrives as a payment rather than a call, this look at how fake refund scams in UPI work<\/a> covers a closely related setup.<\/p>\n

    Who Is Most at Risk, and Who Can Relax?<\/h2>\n

    Most at risk are people who receive unsolicited calls about money and have a reason to believe them. That includes anyone with a pending refund, a loan application in progress, a delivery expected, or a recent failed payment, because the caller only has to mention the thing you are already waiting for.<\/p>\n

    Also most at risk is anyone whose phone holds both the banking app and the number that receives the one time password, which is nearly everyone. That combination is what makes screen access sufficient on its own.<\/p>\n

    At lower risk, though not at none, is anyone who does not install applications from outside an official app store and never acts on an incoming call about money. The fraud needs an installation, and an installation needs your cooperation.<\/p>\n

    You can genuinely relax about one thing. Having screen sharing software on your device for work, installed by you and used with people you know, is not the risk. Nothing on this page suggests removing a tool you chose and control.<\/p>\n

    The practical limit worth stating is that none of this is a guarantee. Reporting inside three working days caps your liability under the framework, which is not the same as the money arriving back on a particular date, and the outcome of any individual complaint depends on the bank\u2019s investigation. What the framework does is decide who carries the loss while that happens. Broader patterns in where these losses cluster are set out in this guide to UPI fraud hotspots and simple safety steps<\/a>.<\/p>\n

    <\/p>\n

    This article is for information only. It is not financial, legal or security advice, and it does not guarantee the recovery of any amount. Rules, liability limits and reporting routes change, and the outcome of any complaint depends on your bank\u2019s investigation, so confirm current details with your bank, the National Cyber Crime Reporting Portal or the Reserve Bank of India, and consult a qualified professional about your own situation.<\/em><\/p>\n\n

    \n
      \n
    1. \n

      Can someone take money from my account through screen sharing?<\/h3>\n
      \n\n

      Yes. Once a session is live the other person can see your banking app and any one time password that appears as a notification, without needing you to read anything out. That is why the usual advice about never sharing an OTP does not protect you in this situation.<\/p>\n\n<\/div>\n<\/li>\n

    2. \n

      How quickly do I have to tell my bank?<\/h3>\n
      \n\n

      Within three working days of receiving the bank\u2019s communication about the transaction, to have zero liability where the fault lies elsewhere in the system. Reporting between four and seven working days caps your liability at your account type\u2019s limit, and beyond seven working days it is decided by the bank\u2019s own board approved policy.<\/p>\n\n<\/div>\n<\/li>\n

    3. \n

      What is the most I can be made to pay if I report late?<\/h3>\n
      \n\n

      For a delay of four to seven working days the maximum is Rs 5,000 for a basic savings bank deposit account, Rs 10,000 for a savings account, prepaid instrument, gift card or credit card up to Rs 5 lakh, and Rs 25,000 for other current accounts and credit cards above Rs 5 lakh, or the transaction value if lower.<\/p>\n\n<\/div>\n<\/li>\n

    4. \n

      Do I have to prove I did not authorise the transaction?<\/h3>\n
      \n\n

      No. The burden of proving customer liability in a case of an unauthorised electronic banking transaction lies on the bank, not on you.<\/p>\n\n<\/div>\n<\/li>\n

    5. \n

      Should I file a police complaint before calling the bank?<\/h3>\n
      \n\n

      No. They are separate processes and only the bank report caps your liability. Call the bank first, then call 1930 and register on the National Cyber Crime Reporting Portal the same day.<\/p>\n\n<\/div>\n<\/li>\n

    6. \n

      Does a bank ever ask me to install software to fix a problem?<\/h3>\n
      \n\n

      No. A bank will ask you to use its own app or visit a branch. No bank, lender, wallet or payment company needs to watch your screen to help you, and none needs you to install a third party tool for money to reach you.<\/p>\n\n<\/div>\n<\/li>\n

    7. \n

      Does the access stop when the call ends?<\/h3>\n
      \n\n

      Not necessarily. A session can continue after the conversation finishes unless it is closed or the device is taken offline, which is why disconnecting mobile data and Wi-Fi is the first thing to do.<\/p>\n\n<\/div>\n<\/li>\n

    8. \n

      Why were there several small transactions instead of one large one?<\/h3>\n
      \n\n

      Smaller amounts attract less scrutiny and are easier to overlook on a statement. Report every transaction you can see rather than only the largest, because the report covers what you name in it.<\/p>\n\n<\/div>\n<\/li>\n

    9. \n

      Is screen sharing software itself dangerous?<\/h3>\n
      \n\n

      No. Screen sharing and remote support tools are ordinary products used legitimately every day. The risk is in being asked to install one by someone who called you about your money.<\/p>\n\n<\/div>\n<\/li>\n

    10. \n

      What do I do if the bank rejects my complaint?<\/h3>\n
      \n\n

      Keep the reference numbers and escalate under the Reserve Bank Integrated Ombudsman Scheme through the portal at cms.rbi.org.in, with guidance available on the Reserve Bank of India contact centre number 14448.<\/p>\n\n<\/div>\n<\/li>\n<\/ol>\n<\/div>","protected":false},"excerpt":{"rendered":"

      Remote access apps feel convenient, but scammers exploit them to drain bank accounts silently. This blog explains how the threat works and how to stay safe.<\/p>\n","protected":false},"author":2,"featured_media":1010,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","rank_math_title":"Screen Sharing Scam: The Three Day Rule That Caps Your Loss","rank_math_description":"A screen sharing scam is an unauthorised transaction. Tell your bank within three working days and your liability can be zero. What to do in the first hour.","rank_math_focus_keyword":"screen sharing scam","rank_math_primary_category":0},"categories":[2494],"tags":[2504],"class_list":["post-13362","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-digital-safety-fraud-prevention","tag-remote-access-scam-india"],"_links":{"self":[{"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/posts\/13362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/comments?post=13362"}],"version-history":[{"count":3,"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/posts\/13362\/revisions"}],"predecessor-version":[{"id":15771,"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/posts\/13362\/revisions\/15771"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/media\/1010"}],"wp:attachment":[{"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/media?parent=13362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/categories?post=13362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.billcut.com\/blogs\/wp-json\/wp\/v2\/tags?post=13362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}