Cyber safety

Why this matters

Most financial fraud in India today doesn't involve breaking into anything. It involves convincing you to hand over access yourself — an OTP read out over the phone, a payment approved because a message called it a "refund," an app installed because it promised instant money. The technology isn't the weak point. The moment of being rushed, frightened, or promised something good is the weak point.

Recognising the pattern matters more than recognising any one scam, because the scripts change constantly. The underlying trick — create urgency or fear, then get you to act before you think — stays the same.

What good looks like

Never share an OTP with anyone. Not your bank, not the police, not a "verification department," not a courier, not anyone. A genuine bank or government official will never ask you to read out an OTP over a call or message. An OTP exists specifically so that only you can authorise a transaction — the instant you share it, that protection is gone. Anyone asking for it, no matter how official they sound, is asking for something a real official never needs. The same rule extends to the details around it: your Aadhaar number, PAN, bank account number, and card details are what let a stranger sound like they already know who you are. Handing those over is what makes the next call convincing.

Recognise the "digital arrest" scam. This is a call — sometimes a video call, sometimes with someone in a fake uniform — claiming you're under investigation, that a parcel with illegal items was found in your name, or that your Aadhaar or bank account is linked to a crime. It pressures you to stay on the call, not tell anyone, and transfer money to "prove your innocence" or avoid arrest. Real law enforcement does not arrest people over a phone or video call, and does not ask for money to make an investigation go away. The callers almost always borrow a name with weight behind it — the CBI, the Enforcement Directorate, Customs, or an anti-terrorism unit — and often send an official-looking warrant, summons, or notice before or during the call to make the story land. None of it changes the one fact worth holding onto: there is no such thing as a "digital arrest" in Indian law. It is not a procedure that exists, so nobody can genuinely be following it. The entire scenario is built to isolate you and stop you from calling anyone who'd tell you it's fake.

Check a notice or warrant instead of believing it. If a notice, summons, or warrant arrives in the name of the police, a court, or the CBI, you can verify it. The CBI runs a portal called Abhay at abhay.cbi.gov.in for exactly this — checking whether a suspicious document sent in an agency's name is real. Official-looking paper is easy to produce; a genuine notice survives being checked, and a fake one depends entirely on you acting before you check. If someone on a call is pressuring you not to verify, that pressure is the answer.

Spot a UPI "refund" that's actually a payment request. A message or call says you're owed a refund, and asks you to open your UPI app and "accept" or enter your PIN to receive it. Receiving money on UPI never requires entering your PIN — a PIN is only ever needed to send money out. If completing a "refund" asks for your PIN, you are not receiving anything; you are about to send money away.

Be wary of fast loan and instant-money apps. Apps promising instant loans with no paperwork often ask for permissions — access to your contacts, photos, and messages — that have nothing to do with lending money. Those permissions are commonly used afterward for harassment or blackmail if repayment is late, or for fraud using your contact list. A legitimate lender doesn't need your photo gallery to assess a loan.

Don't click KYC-expiry links from texts or messages. A message claiming your KYC will expire "today" unless you click a link and re-verify is a common phishing pattern designed to create panic and rush you into entering banking details on a fake page. Banks handle KYC updates through their own app, website, or a branch visit — not a link forwarded over SMS or WhatsApp.

What to do when you see it done wrong

If you or someone you know has just been defrauded, speed matters more than almost anything else on this list. In the first hour: call 1930, the national cyber-crime financial-fraud helpline, and file a report at cybercrime.gov.in. Acting fast gives banks and platforms the best chance to freeze a transaction before the money moves further. Don't spend that hour deciding whether it's "worth reporting" — report first.

If you see someone else being pressured on a call — hesitating, scared, being told not to hang up — that's often the clearest sign something is wrong. A genuine call from a bank or authority doesn't fall apart the moment you say you want to call back on the number printed on your card or a trusted number. Encourage them to hang up and verify independently before doing anything else.