Short answer: Most financial frauds in India work by rushing you into sharing an OTP, PIN or password, installing an app, or sending money to “unlock” something. Never share OTPs or PINs, verify every caller through the official number, check that lenders and investment schemes are registered, and report a fraud immediately: call 1930 or file at cybercrime.gov.in, and tell your bank at once. Reporting fast matters, because RBI rules limit your liability for unauthorised electronic transactions when you report quickly.
Last updated: 13 October 2026.
Our 2022 article listed eight general tips. This 2026 rewrite keeps the eight-point format but updates it for today’s scams, including fake “digital arrest” calls, investment groups on messaging apps and fake loan apps, and adds what to do in the first hour after a fraud.
The 8 points
1. No genuine bank, RBI officer or police will ask for your OTP, PIN or CVV
Fraudsters pose as bank staff, telecom officials, courier companies, tax officials or even police. Whatever the story (KYC expiring, card blocked, parcel with drugs, refund due), the end goal is your OTP, UPI PIN, card details or a remote-access app. Hang up and call your bank on the number printed on your card or passbook.
2. You never need a UPI PIN to receive money
A UPI PIN is only for sending money. If someone sends you a “collect request” or QR code and says you’ll receive a refund or prize after entering your PIN, it is a scam. See our guide to the QR code scam.
3. No law-enforcement agency conducts a “digital arrest”
In this scam, callers claiming to be from police, customs or a central agency keep a victim on video call for hours, show fake documents and demand money to “clear” their name. Real agencies do not arrest or settle cases over video calls or ask you to transfer money for verification. Disconnect and report the number.
4. Guaranteed high returns are a warning sign
Investment fraud now often starts in WhatsApp or Telegram groups that show fake profit screenshots, then move you to an app or website where your “profits” grow on screen but cannot be withdrawn. Before investing, check that the entity is registered with SEBI, RBI or another regulator. The SEBI investor website carries alerts on fake trading apps and “stock market guru” schemes, and RBI’s Sachet portal lets you check registered entities and report unauthorised deposit-taking.
5. Loans that ask for money first are not loans
A genuine lender deducts processing fees from the disbursement or states them in the Key Fact Statement; it does not ask you to pay “file charges” or “insurance” to a personal UPI ID before releasing a loan. Check whether a loan app is linked to an RBI-regulated lender using how to check if a loan app is RBI-approved and our RBI digital lending app list. More red flags are covered in how to identify a fraudulent online lending platform.
6. Don’t install apps or click links sent by strangers
Screen-sharing and remote-access apps let fraudsters see your OTPs as they arrive. Fake APK files sent as “bank KYC” or “wedding invitation” can read your SMS. Install apps only from official app stores, and only those you sought out yourself.
7. Lock down your accounts
- Set transaction limits for UPI, cards and net banking that match your actual use.
- Turn off international and online usage on cards you don’t use that way.
- Use a screen lock and keep your phone’s software updated.
- Enable SMS and email alerts for every transaction and keep your mobile number updated with all banks and lenders.
8. Check statements and your credit report
Review bank and card statements monthly. Also check your credit report a few times a year: a loan you never took is often the first sign of identity theft. Bureaus now send alerts when a lender pulls your report. If you see an unfamiliar lender, read unknown lender in your CIBIL report.
Common scams at a glance
| Scam | How it starts | Red flag |
|---|---|---|
| KYC/account block | SMS or call saying your account will be frozen | Link or app to “update KYC”; OTP request |
| Digital arrest | Call from “police/customs” about a parcel or case | Video interrogation; money to “verify” funds |
| Investment group | Added to a trading tips group | Guaranteed returns; withdrawals blocked |
| Advance-fee loan | Instant loan offer, any credit score | Pay a fee before disbursal |
| Part-time job/task | “Like videos and earn” offers | Pay to unlock bigger tasks |
| Fake customer care | Number found through search results | Asks for remote access or UPI PIN |
| Sextortion | Unknown video call | Threats and payment demands |
What to do in the first hour after a fraud
- Call 1930 (national cybercrime helpline) or file a complaint at cybercrime.gov.in. Quick reporting gives the best chance of freezing funds in the receiving account.
- Call your bank’s official helpline and block cards, UPI or net banking. Get a complaint reference number.
- Report the number or message through the Department of Telecommunications’ Chakshu facility on Sanchar Saathi, which is for suspected fraud calls, SMS and WhatsApp messages.
- Change passwords and uninstall any app the fraudster asked you to install.
- Keep evidence: screenshots, transaction IDs, numbers and chat logs.
How much will you lose? RBI’s liability rules
For unauthorised electronic banking transactions, RBI’s customer-protection rules set your liability largely by how quickly you report (RBI circular on limiting customer liability):
| Situation | Your liability |
|---|---|
| Fraud due to the bank’s own negligence or deficiency | Zero, regardless of when you report |
| Third-party breach, reported within 3 working days | Zero |
| Third-party breach, reported in 4 to 7 working days | Transaction value or a cap (₹5,000 to ₹25,000 depending on account/card type), whichever is lower |
| You shared your OTP, PIN or password | You bear the loss until you report; the bank bears it after |
The bank must provisionally credit the disputed amount (“shadow reversal”) within 10 working days of your notice in eligible cases. Example: ₹40,000 is taken from your savings account through a skimmed card and you report on day 2. Your liability should be zero. If you report on day 6, it should be capped at ₹10,000 for most savings accounts. If you had shared the OTP, the bank can hold you responsible for losses before you reported.
Protect your borrowing too
Fraud can leave you with loans you never took or pressure you into high-cost borrowing to cover a loss. Stick to RBI-regulated lenders, read the KFS before signing, and see common loan scams and how to protect yourself. For broader protection, personal cyber insurance can cover some fraud losses, subject to exclusions. If a lender or bank does not resolve a complaint, the RBI rules hub explains how to escalate.
Need a loan? Compare offers only from RBI-regulated lenders, with no upfront fees.
Frequently asked questions
What is the cyber fraud helpline number in India?
1930. You can also file a complaint at cybercrime.gov.in. Report as soon as possible.
Will my bank refund money lost to fraud?
If you did not share credentials and report within three working days, RBI rules make your liability zero for unauthorised electronic transactions. If you shared your OTP or PIN, you may bear the loss until you reported.
Is a ‘digital arrest’ real?
No. Indian law-enforcement agencies do not arrest people over video calls or ask for money transfers to verify you. It is a scam.
How can I check if an investment scheme is genuine?
Check whether the entity is registered with SEBI, RBI or the relevant regulator, and be wary of guaranteed high returns. RBI’s Sachet portal lists registered entities and accepts complaints about unauthorised schemes.
A loan app asked me to pay a fee before disbursal. Should I pay?
No. Genuine lenders disclose fees in the Key Fact Statement and usually deduct them from the loan amount; they do not ask for advance payments to personal accounts.
Sources
- RBI: Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions (6 July 2017)
- Department of Telecommunications: Chakshu – report suspected fraud communication
- RBI: Sachet portal
- SEBI: Investor website
Disclosure: FundsTiger (Gatimaan Finance Advisors Pvt. Ltd.) is a loan marketplace and lending service provider for RBI-regulated lenders. Aparampaar Finance Pvt. Ltd. (Omozing), one of those lenders, is a related party of FundsTiger. This article is general information, not financial advice. Read your loan agreement and KFS before you decide.