Cyber Security Basics for Indians: UPI Frauds, Phishing, OTP Scams and How to Stay Safe

Most online fraud in India does not involve clever hacking. It works because someone is rushed, frightened or tempted into doing the attacker's work: sharing an OTP, installing an app, or sending money. Knowing the common patterns and a few habits stops the great majority of attacks.

The scams you are most likely to meet

Habits that protect you

1. Slow down. Every scam builds urgency. A genuine problem will survive a ten-minute pause to call the official number.
2. Use official apps and websites only. Type the address yourself or use the app store listing from the real company.
3. Turn on two-factor authentication on email, banking and social accounts, and keep your email account especially secure.
4. Use unique passwords with a password manager and test ideas with the password strength checker.
5. Keep devices updated, including the phone operating system and apps, and install apps only from official stores.
6. Set UPI and card limits and enable transaction alerts. Switch off international card use if you do not travel.
7. Be careful on public Wi-Fi. Avoid banking on open networks, or use mobile data.
8. Back up important files, so ransomware or a lost phone does not cost you everything.

Spotting phishing

• Sender address or link does not match the real company, or uses a lookalike spelling.
• Pressure: "within 24 hours", "last warning", "your account will be closed".
• Requests for sensitive information, payments or gift cards.
• Poor language or unexpected attachments. Long links are often shortened to hide the destination.

Hover over a link before tapping, and if in doubt, open the service directly. You can also inspect where a link points using the URL parser.

If you are cheated: act within minutes

1. Call the national cyber crime helpline 1930 immediately. The sooner a fraud is reported, the better the chance that the money is frozen before it moves on.
2. Report on the National Cyber Crime Reporting Portal (cybercrime.gov.in) with transaction IDs, screenshots, phone numbers and website addresses.
3. Inform your bank and block cards or UPI if needed. Ask for the incident to be logged.
4. Change passwords for accounts that could be affected, and remove any suspicious app.
5. Keep evidence and do not delete messages.

The Reserve Bank's rules limit your liability for unauthorised electronic transactions if you report quickly, but they do not cover cases where you shared your own credentials, so reporting fast and not sharing OTPs both matter.

For parents and older relatives

Older people and children are frequent targets. Set up a shared rule: no one sends money, shares an OTP or installs an app because of a call, however official it sounds, without first speaking to a family member. Put a spending limit on UPI for older relatives, and teach children not to click links in games and chats.

Protecting your identity

• Share Aadhaar and PAN only when needed. Use masked Aadhaar where allowed.
• Lock Aadhaar biometrics when you are not using them.
• Check your credit report once a year for loans you did not take.
• Be careful what you post: birthdays, travel plans and ID photographs help attackers.

This is general guidance. Tactics change constantly, so rely on current advisories from your bank, CERT-In and the cybercrime portal.

Frequently asked questions

What should I do first if I lose money to a scam?

Call 1930 immediately, then report on cybercrime.gov.in and inform your bank.

Do I need to enter my UPI PIN to receive money?

No. A PIN is only needed to send money. A request asking for your PIN to receive money is a scam.

Will a bank ask for my OTP?

Never. Do not share an OTP, PIN or CVV with anyone.

How can I check if an investment platform is genuine?

Verify the broker or adviser on the SEBI website, and avoid groups promising guaranteed returns.

What is a digital arrest scam?

Fraudsters posing as police or officials claim you are under arrest on a video call and demand money. No agency does this.

Is public Wi-Fi safe for banking?

Avoid it. Use your mobile data for financial transactions.

Last reviewed 8 November 2026. Rates, limits and rules change, so confirm figures with the official source before you act.