ndia’s telecom regulator is considering a standard format for one-time password messages in an attempt to make genuine OTPs easier to identify and reduce their misuse in online fraud.
The Telecom Regulatory Authority of India, or TRAI, has discussed the proposal with telecom operators in several meetings and could issue a consultation paper before taking a final decision.
Under the plan, OTP messages sent by banks, e-commerce platforms and digital services could follow a common structure.
The message may be required to clearly explain why the OTP was generated, identify the company sending it and state how long the code remains valid.
No new rule has been implemented yet.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
OTP Messages Could Follow One Standard Format
At present, companies use different formats for OTP messages.
Some display the verification code immediately in the notification preview, while others require users to open the complete message.
The wording, placement of the code and information about its purpose can also vary significantly.
TRAI is reportedly considering whether these messages should follow a more predictable format.
One proposal would require an OTP message to clearly mention whether the code is being used for a login, payment, transaction confirmation or another activity.
The sender’s identity would also have to be clearly visible.
Another proposed field would show the validity period of the OTP.
The regulator is also examining whether the way OTPs appear in phone notifications can be changed so the code is not automatically visible to someone looking at the screen.
The objective is to make authentic messages easier for consumers to recognise.
Cyber Fraud Complaints Have Risen Sharply
The proposal comes against the backdrop of rapidly increasing financial cyber fraud in India.
Home Ministry figures cited in reports show that financial fraud complaints registered through the National Cyber Crime Reporting Portal rose from about 2.62 lakh in 2021 to 24.02 lakh in 2025.
The amount involved in those complaints increased from ₹551 crore to ₹22,495 crore during the same period.
These figures cover all forms of financial cyber fraud rather than OTP scams alone.
There is no separate official figure showing how much money has been lost specifically through misuse of OTPs.
But OTP theft remains a common element in fraud involving fake bank officials, customer-care impersonation, phishing and account takeovers.
A scammer may claim that a bank account needs KYC verification, a refund is pending or a transaction must be cancelled.
The victim is then persuaded to disclose the OTP required to authorise access or payment.
Standardisation Will Not Stop Fraud by Itself
Security experts have cautioned that a common OTP format is not a complete solution.
Fraudsters may simply copy the standard message style once it becomes familiar to consumers.
That means the effectiveness of the proposal will depend on whether genuine messages contain information that users can independently verify.
Former TRAI principal adviser Satya N. Gupta said standardising templates could help consumers but warned against excessive intervention in the technical design of OTP systems.
Industry experts also point out that companies increasingly use WhatsApp and other messaging services to send authentication codes.
A standard designed primarily around SMS may therefore not cover every platform used for OTP delivery.
The proposal is better understood as an additional safety layer rather than a replacement for existing fraud controls.
TRAI Has Already Tightened Commercial SMS Rules
TRAI has already introduced several measures aimed at reducing abuse of commercial messages.
Banks, companies and other bulk senders are required to register message templates and sender identities with telecom operators.
Telecom providers are expected to ensure that commercial messages match approved templates before they are delivered.
In November 2025, TRAI also directed telecom operators to strengthen controls over variable sections inside commercial SMS templates.
These are parts of a message that can change, such as website links, app download links and callback numbers.
The objective was to prevent criminals from taking an approved message template and inserting a fraudulent link or phone number into it.
Telecom companies have introduced their own fraud-detection systems as well.
Airtel, Jio and Vodafone Idea have deployed spam alerts, suspicious-number detection and other protections intended to identify risky communications.
The Department of Telecommunications has separately expanded fraud-detection tools based on artificial intelligence and telecom network data.
A uniform OTP template would add another layer focused directly on the messages consumers see.
What this means for you:
Even if TRAI introduces a standard OTP format, never share an OTP with someone who calls or messages you unexpectedly. If an OTP arrives for a transaction you did not initiate, check your bank or account immediately rather than responding to the message.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
