The Warning in a Language Nobody Speaks: On what a bank says when it is not talking to you

The message arrived on a Friday, from my credit card issuer, in Tamil. The sender header read AD-SBICARD-P. The P stands for promotional. Somewhere in the bank's own routing, a warning about fraud had been filed under the same category as a cashback offer or a festive season EMI scheme. Whoever built that mapping was not being careless. The category exists to sort every outbound message the bank sends, and this message had to go in one of them, and promotional was the one that fit a text with no service request behind it. The header was precise about what kind of message this was allowed to be. It said nothing about what it actually contained.

சரிபார்க்கப்படாத இணையதளங்களிலிருந்து செயலிகளை பதிவிறக்கம் செய்யவேண்டாம்.

Do not download applications from unverified websites. That is the translation. It is not the experience. The experience was of standing at my own mother tongue the way you stand at a government counter. Waiting for the sentence to acknowledge you. இணையதளம் for website. செயலி for app. பதிவிறக்கம் for download. These are committee coinages. They are correct the way a form is correct. I teach strategy for a living. I read Maṇipravāḷam commentary for pleasure. The message still took me two readings. I tried to imagine the reader it was built for. I could not find him.

Then I asked the more interesting question. Why Tamil at all?

I have never told this bank my preferred language. No field in the card application asked. No app setting was toggled. What the bank knows is my pin code. An address in Tamil Nadu resolved to a language called Tamil somewhere in a compliance workflow, and a translation vendor did the rest. The Reserve Bank has been reminding banks for years that customer communication must be issued in Hindi, English, and the concerned regional language. It reiterated the instruction in writing in September 2024. Note the grammar of that mandate. The regional language. Not the customer's language. One is assigned by geography. The other would have required someone to ask.

Here is the detail that gives the game away. The people this warning is nominally protecting do not say இணையதளம். They say லிங்க். They do not say செயலி. They say ஆப். They do not say பதிவிறக்கம். They say டவுன்லோட். That is the Tamil that actual fraud travels in, on WhatsApp forwards and cousin's recommendations and voice notes. Warm, borrowed, alive. The Tamil the warning travels in is glossary Tamil, approved by a committee that will never be tested on whether anyone understood it. The message is in the regional language. It is not in the language of the region. Those are different things, and the difference is the whole story.

Now look at what the sentence actually says. Do not download apps from unverified websites. Unverified by whom? Is the Play Store verified? It hosts malware every year. Is an APK mirror unverified? Is the bank's own promotional microsite, the one that arrives by SMS with a shortened link, verified? The message raises the question and declines to answer it. The declining is not sloppiness. Name the safe sources and you own the day one of them turns out unsafe. Name the unsafe ones and you own the omissions. Vagueness carries no such exposure. So the warning is calibrated to be exactly useless. Broad enough to cover any fraud that may ever occur. Empty enough to prevent none of them. There was no link in it, no number to call, nothing to click through to. Delivered as an SMS, inside a hundred and sixty characters, which is room enough for the instruction and none at all for the explanation. The medium itself absolves the sender. A text message cannot be expected to define unverified. Only to say the word and move on.

The lament has to stop here and the mechanism has to be named, because the mechanism explains everything the lament can only complain about.

In July 2017 the RBI issued its circular on limiting customer liability in unauthorized electronic banking transactions. It is a genuinely protective document. Report a fraud in time and your liability can be zero. But the circular also draws a line around your own negligence: sharing an OTP, say, or installing a screen-sharing app at a stranger's instruction. Cross that line and you bear the loss until you report it. And the burden of proving you crossed it sits with the bank, not with you. The same circular instructs banks to keep advising customers, continually and repeatedly, on how to protect themselves. In January 2025 the RBI went further, directing regulated entities to run that awareness campaign through emails and SMS, expressly including vernacular languages.

Read the two requirements together and the Friday message becomes perfectly legible. The regulator wants the bank to prove it warned me, repeatedly, in my own language. A single SMS discharges both requirements at once. Continually and repeatedly advised, the file will say. In the regional language, the file will add. The delivery log is timestamped. Whether I understood இணையதளம் is not a field the system records, because comprehension was never the deliverable. The message was not addressed to me. It was addressed to a dispute that has not happened yet. I merely live at the phone number where the evidence gets deposited.

I recognized the shape immediately, and that recognition is the part I am least comfortable admitting. Every semester I write a course outline and list, against each session, what a student will be able to do by the end of it. That list is a commitment. Nobody checks it the way a commitment should be checked. Once the outline is filed, what gets tracked is attendance and a grade distribution, not whether the sentence I wrote in that outline turned out to be true. I have sat in meetings where a colleague asked whether a stated outcome was actually being met, and watched the room agree that outcomes are hard to measure for a course like this, and move on. I have filed outlines I knew were sincere and unverifiable in the same breath. I am not separate from the mechanism I am describing. I have operated one.

That does not make the bank's warning less empty. It makes the emptiness more familiar than I would like.

I keep returning to the man the message was supposed to reach. He is the reason both circulars were written. He will get the same SMS I got, from the same sender ID, in the same glossary Tamil, and he will do what I nearly did. Delete it unread, because it looks like every other message that has never once concerned him. The warning cost the bank one API call and a translation vendor's invoice. It will sit in a log, satisfy an audit, and reach no one.

Some months from now his phone will ring. A voice will speak to him in fluent, unhurried Tamil, his Tamil, the Tamil of the tea stall and not the circular. It will not say செயலி. It will say ஆப். It will not say இணையதளம். It will say லிங்க், and it will already have sent one. It will know which bank he uses, and sometimes his mother's maiden name, and sometimes the branch manager's name. It will not rush him. It will wait through his hesitation and answer his questions in the order confusion actually asks them, not the order a compliance template lists them. It will call back if the line drops. It will sound, more than anything his bank sent him all year, like someone who cares whether he understands.

This is not a coincidence of skill. It is a difference in what each side was built to optimize. The bank's warning had to satisfy a regulator who checks whether the artefact exists. The fraudster's script has to satisfy the only auditor who matters to him, the man on the line, sentence by sentence, or the call ends and the money does not move. One side is graded on delivery. The other is graded on comprehension. Naturally the second one sounds more like Tamil.

The bank spent a template. The fraudster spent an afternoon learning how he talks. My own course outline for MBA students spent a sentence. Somewhere, a student I never checked on spent a semester learning how much of that not-checking he could count on.

I do not know which of us owes him the larger apology. The bank that warned him in a language built to satisfy an auditor, or the professor who has, on more Tuesdays than he would like to count, done exactly the same thing to a room full of students who trusted the outline on the course material.

The log will say I taught the course. It will not say whether he understood it either.