Online banking safety is not about remembering a hundred scary stories. It comes down to controlling how you reach your bank, what you approve and how quickly you notice an unexpected transaction. The app may look official and a caller may sound convincing, but neither should override a basic rule: your PIN, password and one-time code are not instructions to follow on somebody else’s request.
Before you log in
- Use the bank’s official app or a bookmark you created from the bank’s verified website. Do not follow a login link from an unexpected SMS, email or WhatsApp message.
- Keep the phone/computer and browser updated. Remove apps you no longer use, especially sideloaded APKs and remote-control tools.
- Use a unique banking password. Do not reuse the same password on shopping, social or email accounts.
- Protect the email account linked to the bank with strong MFA because email is often part of account recovery.
Understand what an OTP and UPI PIN actually do
An OTP, card PIN, CVV and UPI PIN are authorisation secrets. A legitimate bank employee does not need you to read them out on a phone call. For UPI, entering your PIN normally authorises a transaction from your account; you do not need to enter a UPI PIN merely to receive money.
Common scam patterns
“Your KYC will expire today”
The message sends a link or APK. Verify any KYC request from inside the official bank app or by calling the number printed on the bank’s official website/card.
Fake customer-care numbers
Search results, social posts and map listings can be manipulated. Go to the company’s official domain first, then use its listed support route.
Refund or collect-request trick
A scammer claims to send you money but actually sends a collect request. Read the action on screen before entering a PIN.
Remote-access “support”
Do not install AnyDesk, TeamViewer or similar remote-control software because a caller says it is required to fix a banking issue.
If you spot an unauthorised transaction
- Contact the bank through an official fraud channel and ask it to block/freeze the relevant instrument where appropriate.
- For financial cyber fraud, call 1930 quickly and complete the complaint on cybercrime.gov.in.
- Save transaction IDs, screenshots, messages and caller details.
- Change compromised credentials from a trusted device and review active sessions.
A monthly banking-safety check
Review beneficiaries, UPI mandates/autopay instructions, cards, transaction alerts, account recovery email/phone numbers and apps with Accessibility/Device Admin permissions. Remove what you no longer use.
Sources and verification
This is general security information, not financial or legal advice. Bank processes and liability rules can depend on the facts and timing of a specific incident.
What this advice is based on
This guide is written as a defensive, India-focused response guide. It does not claim a personal incident unless that experience is documented, and it does not guarantee recovery after fraud. Official reporting and payment/identity sources take priority over anecdotes.
A practical next step
Set up transaction alerts and check that the phone number and email on your bank account are current. When something looks wrong, open the bank app separately instead of tapping the link in the warning message. Contact the bank through its verified channels quickly if you suspect an unauthorised transfer.