Kasaragod: An overseer with KSEB, Kerala's power distribution company, lost nearly Rs 5.5 lakh to cybercriminals after he shared the one-time password (OTP) with them four times.

But apart from making the cardinal mistake of sharing the OTPs, Manohara K of Kanhangad believes the cybercriminal hacked his account with the State Bank of India (SBI) because he did not remember sharing his username and password with anyone.

Hosdurg Police initially tried to close his complaint saying it had been transferred to the Cyber Police Station, Manohara said. But he went to the Hosdurg station again and they registered an FIR on Tuesday, January 24, he said.

Around 9.30 am on January 10, when Manohara (56) tried to log into SBI's mobile app YONO (You Only Need One), he received a pop-up message saying the app was blocked. Around the same time, he got a phone call. "The caller identified himself as SBI Service Centre Manager," said Manohara. "I did not doubt because the TrueCaller also identified the caller as State Bank of India Service Centre," he said.

The caller said he would need an OTP to unblock the YONO app. Manohara read out the OTP he received but did not see the message that accompanied it. "74**83 is OTP to change your email address. Do not share with anyone - SBI".

After nearly 10 minutes, the 'SBI Service Centre Manager' called again for another OTP. This one was for adding a beneficiary to his bank account to receive money. After he shared the OTP, a beneficiary was added to his account.

Later, when he shared the OTP for the third time, he lost Rs 4,99,900. Only he did not know.

When Manohara shared the OTP for the fourth time, he lost another Rs 50,000. He was left with just Rs 4,100.

Manohara said he received the OTP text messages promptly but got messages intimating him about the illegal transfers 10 minutes late. "The two SMS came together, back to back," he said.

Manohara rushed to the Hosdurg branch of SBI to inform them about the cheating. The bank found that the money was siphoned to a Canara Bank account in Kolkata. The account had Rs 3,69,990. The account was frozen in 30 minutes on January 10. But by then, the balance depleted to Rs 1.89 lakh, said Manohara. "The money was transferred to around 50 different accounts," he said.

An investigating officer at Hosdurg said he took the statement of the Canara Bank account of the alleged scammer in Kolkata. "The account had a balance of Rs 41,000 on January 1. It received around Rs 15 lakh till it was frozen by the bank based on Manohara's complaint," the officer said.

On the request of the police, banks have frozen three accounts that received Rs 20,000, Rs 50,000 and Rs 30,000, said Manohara.

Cheating related to the YONO app is the latest scam story, said the officer. "We have received two more complaints. One man lost Rs 49,000 and a woman lost Rs 23,000 to a similar story saying their YONO app is blocked," he said. In all the police station is investigating around 20 cybercrime complaints now.

The officer said the bank told him that Manohara clicked a link sent to him as a text message. The link opened as a web page of the bank.

However, Manohara insisted that he did not click any link or share the username and account password with anybody.

The bank's data could have been breached, said the manager of a private bank in Kanhangad. "Or his phone could have been hacked and scamsters took control of the YONO app locally. But if the cybercriminals could access his phone, they would not have asked for his OTP," he said. The police will have to find out how the scamsters got Manohara's bank account credentials.