Cyber safety

Why this matters

Most financial fraud in India today doesn't involve breaking into anything. It involves convincing you to hand over access yourself — an OTP read out over the phone, a payment approved because a message called it a "refund," an app installed because it promised instant money. The technology isn't the weak point. The moment of being rushed, frightened, or promised something good is the weak point.

Recognising the pattern matters more than recognising any one scam, because the scripts change constantly. The underlying trick — create urgency or fear, then get you to act before you think — stays the same.

What good looks like

Never share an OTP with anyone. Not your bank, not the police, not a "verification department," not a courier, not anyone. A genuine bank or government official will never ask you to read out an OTP over a call or message. An OTP exists specifically so that only you can authorise a transaction — the instant you share it, that protection is gone. Anyone asking for it, no matter how official they sound, is asking for something a real official never needs.

Recognise the "digital arrest" scam. This is a call — sometimes a video call, sometimes with someone in a fake uniform — claiming you're under investigation, that a parcel with illegal items was found in your name, or that your Aadhaar or bank account is linked to a crime. It pressures you to stay on the call, not tell anyone, and transfer money to "prove your innocence" or avoid arrest. Real law enforcement does not arrest people over a phone or video call, and does not ask for money to make an investigation go away. The entire scenario is built to isolate you and stop you from calling anyone who'd tell you it's fake.

Spot a UPI "refund" that's actually a payment request. A message or call says you're owed a refund, and asks you to open your UPI app and "accept" or enter your PIN to receive it. Receiving money on UPI never requires entering your PIN — a PIN is only ever needed to send money out. If completing a "refund" asks for your PIN, you are not receiving anything; you are about to send money away.

Be wary of fast loan and instant-money apps. Apps promising instant loans with no paperwork often ask for permissions — access to your contacts, photos, and messages — that have nothing to do with lending money. Those permissions are commonly used afterward for harassment or blackmail if repayment is late, or for fraud using your contact list. A legitimate lender doesn't need your photo gallery to assess a loan.

Don't click KYC-expiry links from texts or messages. A message claiming your KYC will expire "today" unless you click a link and re-verify is a common phishing pattern designed to create panic and rush you into entering banking details on a fake page. Banks handle KYC updates through their own app, website, or a branch visit — not a link forwarded over SMS or WhatsApp.

What to do when you see it done wrong

If you or someone you know has just been defrauded, speed matters more than almost anything else on this list. In the first hour: call 1930, the national cyber-crime financial-fraud helpline, and file a report at cybercrime.gov.in. Acting fast gives banks and platforms the best chance to freeze a transaction before the money moves further. Don't spend that hour deciding whether it's "worth reporting" — report first.

If you see someone else being pressured on a call — hesitating, scared, being told not to hang up — that's often the clearest sign something is wrong. A genuine call from a bank or authority doesn't fall apart the moment you say you want to call back on the number printed on your card or a trusted number. Encourage them to hang up and verify independently before doing anything else.