Most digital banking fraud in India today doesn't rely on hacking — it relies on you being asked, calmly and convincingly, to hand over access. A screen-share request, a fake "KYC update" link, a call from someone who already knows your name and bank. None of it needs to be sophisticated if it's convincing. Run through this checklist once a month; it takes about ten minutes.
1. The rules that stop 90% of scams
- No bank ever asks for your OTP, PIN or CVV over a call, SMS or email. Anyone asking for these — even someone claiming to be from your bank's fraud department — is not your bank.
- Never install a remote-access app (like AnyDesk or TeamViewer-style tools) because someone on a call asked you to, even if they say it's to "fix" or "verify" something.
- UPI collect requests can drain money, not just receive it. Approving a "collect" request sends money out. If you didn't initiate a payment, don't approve any request that lands in your UPI app.
- A genuine refund or cashback never requires you to enter your UPI PIN. Entering a PIN is only ever needed to send money, never to receive it.
2. The 10-minute monthly check
- Open your bank app and scroll through the last month's transactions — look for anything you don't recognise, even small amounts (fraudsters sometimes test with tiny transactions first).
- Check which apps have UPI or account access under your bank's "linked devices" or "manage UPI" section — remove anything you no longer use or don't recognise.
- Confirm your registered mobile number and email are current — this is where fraud alerts and OTPs go.
- Make sure SMS and app-based transaction alerts are switched on for every account and card.
- If you use screen locks, biometrics or an app-lock on your banking apps specifically, verify it's still active — phone repairs and OS updates occasionally reset these.
3. Spotting a fake link or message
Common red flags: urgency ("your account will be blocked in 2 hours"), a link that doesn't match your bank's actual domain when you hover over it, requests to "verify" via a form instead of your bank's own app, and messages with slightly-off logos or grammar. When in doubt, don't click — open your bank's app directly or call the number printed on your card, not a number given in the message.
4. If something has already gone wrong
- Call your bank's fraud helpline immediately and block the card or account.
- Report the incident on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call 1930, the national cyber-fraud helpline.
- Under RBI's limited-liability rules, reporting an unauthorised transaction promptly can significantly limit your liability — the faster you report, the stronger your position.
- Change your net-banking password and UPI PIN as soon as you're able to.
None of this requires technical skill — just a habit. Put a reminder on your calendar for the first of every month and run through the checklist above.
