A credit card telecaller on a personal mobile knew my PAN, employer and even my other bank

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

"A man called from a normal mobile number to sell me a credit card. He read out my PAN, my company and the bank where I already have a card."

Card and loan sales are often done by DSAs (direct selling agents) for a bank. The bank answers for its agents and must make sure they see customer data only on a need to know basis. Ask the bank named by the caller whether this person is its agent and how they got your PAN.

Safety first. Threatened or in danger: call 181 (women) or go to the nearest police station. Lost money: call 1930 at once.

Not legal advice. This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.

Step 1: stay safe and find out who it is

1. Do not share an OTP, PIN, CVV, password or card number, even if the caller knows everything else about you.
2. Ask for their full name, role, employee or agent ID, branch and the agency they work for. Write it down.
3. Say you will call back. Hang up.
4. Call the bank on the number printed on your card, passbook or in its official app. Ask if this person works for the bank or for an agency it uses.
5. Check the caller's number under Trusted Contact Details on Sanchar Saathi. Official numbers of banks and financial companies are listed there.
6. Ask the bank to confirm in writing (Letter 1 below).

If it is genuine: hold the company accountable

Which rules this may break

• RBI Outsourcing Directions, 2025 (para 17): the bank stays responsible for the actions of its service providers, including DSAs, DMAs and recovery agents, and for the confidentiality of customer information they hold.
• Same Directions (para 24): agents may see customer information only on a need to know basis.
• Same Directions (para 28): the bank must tell RBI at once about a breach or leak of confidential customer information, and is liable to its customers for any damage.
• RBI Charter of Customer Rights (2014), Right to Privacy: personal information must be kept confidential unless you consent, the law requires it, or for a mandated purpose.
• SPDI Rules, 2011: bank account, card and other financial details are sensitive personal data (rule 3). They may not be disclosed to a third party without your prior permission (rule 6).
• IT Act section 43A (until 13 May 2027): negligence with sensitive data that causes wrongful loss or gain means compensation.
• IT Act section 72A: a person who discloses your information in breach of a lawful contract, to cause wrongful loss or gain, commits a crime (up to 3 years or fine up to Rs 5 lakh).

What the company must do, and by when

• Give you a complaint number and a written acknowledgement.
• Check whether the caller is its employee, DSA, DMA or recovery agent, and what customer data that person could access.
• Reply to you within 30 days. If it does not, or you are not satisfied, you can go to the RBI Ombudsman.
• Tell RBI at once if confidential customer information leaked (Outsourcing Directions, para 28).
• Act against the person or agency. Ask in writing what it did; the Directions keep the bank responsible for its agents.
• From 13 May 2027: tell you what data it holds and who it shared it with if you ask (DPDP section 11), and report breaches to you and the Board (section 8(6)).

Letter 1: ask them to confirm who the caller is

Send it through the official channel. Keep a copy and the acknowledgement.

To: The Grievance Officer, [Bank name]
Subject: Please confirm whether this person works for you

Dear Sir or Madam,

I am your customer. My account or customer ID: [number].

On [date] at [time] I received a call or message from [phone number]. This is not an official number. The person said they were [name], [role or employee ID], from the bank. They knew my [list the details they knew].

Please confirm in writing within 7 days:
1. Whether this person is your employee, agent, DSA, DMA, recovery agent or partner.
2. If yes, their name, role and the agency they work for.
3. Whether you allow staff or agents to contact customers from personal numbers.
4. If they are not connected with you, please say so, so I can report the number.

Name:
Registered mobile number:
Date:

Letter 2: ask how your data got there

To: The Grievance Officer, [Bank name]
Subject: How did my personal data reach a personal phone? Complaint number [if any]

Dear Sir or Madam,

On [date] a person connected with you, [name if known], contacted me from a personal number [number] and knew my [details]. [Describe what they did.]

Please tell me in writing:
1. What personal data about me this person could see, and through which system or app.
2. Whether you shared my data with any agency, DSA, DMA, recovery agent, partner or processor, and their names.
3. How my data reached a personal phone or account outside your official systems.
4. What action you have taken against the person or agency, including suspension while you investigate.
5. What you have done to stop this happening again.
6. Whether you have reported this to RBI, as the 2025 Outsourcing Directions require for a leak of confidential customer information.
Under the RBI (Commercial Banks: Managing Risks in Outsourcing) Directions, 2025 the bank is responsible for its service providers, including DSAs and recovery agents, and for the confidentiality of customer information they hold, and must notify RBI of a leak of confidential customer information.

From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply.

Please reply within 30 days. If I do not hear from you, I will escalate to the RBI Ombudsman.

Name:
Registered mobile number:
Date:

Evidence to keep

• Screenshots of calls and messages with numbers, dates and times.
• Order, booking, policy or account numbers.
• Your complaint numbers and the company's replies.
• A note of what the caller knew or did.

More in the evidence checklist.

Can you sue? What realistically happens

• Consumer Commission: the most practical route for compensation. Cheap, no lawyer needed, file within 2 years.
• IT Act section 43A (until 13 May 2027): if the company was negligent with sensitive personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules.
• Civil suit for damages: possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide.
• Police: only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats.
• Realistic outcome: most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing.

From 13 May 2027: the Data Protection Board

From 13 May 2027 the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but penalties go to the Government (the Consolidated Fund of India, section 34), not to you. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).

If it is fake: urgent steps

1. If anyone asks for an OTP, PIN or payment, stop. It may be fraud.
2. Call 1930 if money was lost, then file on cybercrime.gov.in.
3. Report the number on Chakshu (Sanchar Saathi).

Step by step guides:

Related guides

• Banks Fraud, unauthorised transactions, data misuse and how to reach the RBI Ombudsman.
• Spam calls, SMS and telemarketing Block marketing, complain within 7 days, and report fraud calls on Chakshu.

See also when a platform shares your data with a third party and the escalation ladder.

Official sources

Checked on 1 November 2026. Company pages are labelled as the company's own words.

• RBI (Commercial Banks: Managing Risks in Outsourcing) Directions, 2025 (28 November 2025)
• RBI releases Charter of Customer Rights (3 December 2014)
• RBI: Reserve Bank Integrated Ombudsman Scheme, 2026 (FAQs)
• RBI Complaint Management System (CMS)
• IT (Reasonable Security Practices and Sensitive Personal Data) Rules, 2011 (India Code)
• IT Act section 43A: compensation for failure to protect data (India Code)
• Information Technology Act, 2000, updated text (India Code)
• Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)