Can an AI voice agent ask customers for OTPs or card details?
No, it should not. RBI and banks repeatedly tell customers never to share OTPs, PINs or card details on a call, so asking for them makes a legitimate business sound like a fraudster. RBI's tokenisation rules bar merchants from storing card numbers, and the DPDP Act 2023 requires reasonable security safeguards. Take payment through a link, UPI request or payment gateway sent during or after the call.
Why voice is the wrong channel for secrets
Phishing calls asking for OTPs are among the most common frauds in India, and RBI's public awareness campaigns tell people never to share them. A legitimate business that asks for an OTP on a call trains customers into unsafe habits and invites complaints. Anything spoken on the call also ends up in recordings and transcripts, which then become sensitive data you must secure.
What the rules say
- —Since October 2022, RBI's card-on-file tokenisation rules have barred merchants and payment aggregators, other than card issuers and networks, from storing actual card data.
- —PCI DSS, which card networks require of anyone handling card data, makes capturing card numbers and CVVs in call recordings a serious compliance problem.
- —Under the DPDP Act 2023 the business must take reasonable security safeguards, and the most serious breaches can attract penalties of up to ₹250 crore.
How to take payment on an AI call
- 01The agent confirms the amount and what it is for.
- 02It sends a payment link or UPI collect request by WhatsApp or SMS while the customer is on the line.
- 03The customer pays in their own banking or UPI app.
- 04Payment status comes back through your payment system's webhook, and a follow-up message confirms it.
How Outpero fits
Outpero can send a WhatsApp message during or right after the call and call your API to check payment status, which keeps card numbers and OTPs off the call entirely.
Add an explicit instruction: the agent must never ask for, repeat or accept OTPs, PINs, CVVs or full card numbers, and should tell callers the business will never ask for them.
Want to hear an AI voice agent handle this on a real call?