Digital fraud: recognise the trap, protect payments and report quickly

The core idea

Pause unexpected requests, verify through a contact you find independently and keep payment credentials private. After suspected financial fraud, notify the bank immediately, call 1930 and use the official cybercrime portal.

The scam usually starts with a story

An unexpected caller may claim that a pension will stop, a parcel contains something illegal, a refund is waiting or a relative urgently needs money. The story creates a reason to act before checking. A logo, familiar name or confident voice does not establish identity. The important question is what action the caller is trying to obtain.

Look for the sequence: claim of authority or reward, time pressure, secrecy, then a request for money, a credential or control of the device. Recognising this pattern is more useful than memorising one exact message, because the wording can change while the mechanism stays similar.

Sources: RBI: safeguards for digital banking ↗ · I4C: advisory on digital-arrest scams ↗

Know what a password, OTP and PIN do

A password protects access to an account. An OTP is a one-time code used for a specific verification or action. A payment PIN authorises sensitive payment activity. These are not harmless reference numbers to read to a helpful stranger. RBI advises keeping passwords, PINs, OTPs, CVV and UPI PINs private.

An account number or transaction reference may be needed in a genuine complaint through an official channel, but that does not mean a caller needs your payment secret. When a helper explains a process, you should complete the sensitive step yourself. Read the message describing what the code authorises before acting.

Sources: RBI: safeguards for digital banking ↗

Paying and receiving are different actions

For an ordinary UPI payment, scanning a merchant’s payment QR and entering your UPI PIN is a way to send money. NPCI warns against being told to scan a QR and enter a PIN to receive a reward or refund. Check the recipient and amount displayed in your own app; a stranger’s screenshot is not proof of a credit.

In a fictional example, a buyer promises ₹4,000 for a used chair, then sends a QR to “receive the amount”. If the screen is asking you to authorise a payment, stop. The story says you are receiving; the action on the screen says you are paying.

Sources: NPCI: recognising payment fraud ↗

Break pressure with independent verification

End a suspicious call and find the organisation’s contact independently through its official app, website or your existing records. Do not use a number or link supplied by the same caller as proof that the caller is genuine. Avoid installing an unfamiliar app or sharing your screen at an unsolicited caller’s request.

I4C warns that “digital arrest” has no basis in Indian law. Fraudsters may impersonate officials on video and demand money to clear an allegation. Do not transfer money under this pressure. Contact the real authority through an independently verified route and speak with a trusted person instead of accepting enforced secrecy.

Sources: I4C: advisory on digital-arrest scams ↗ · RBI: Financial Awareness Messages ↗

Act promptly after suspected financial fraud

Contact your bank immediately using its official fraud-reporting route and ask how to secure the affected account or payment instrument. Call 1930 for financial cyber fraud and report through cybercrime.gov.in. Follow the operator’s instructions and complete any requested follow-up; keep every acknowledgement. Do not wait to assemble a perfect report before alerting the bank and helpline.

Fast reporting can help attempts to stop further movement of funds, but recovery is not guaranteed. A second person promising certain recovery for a fee may be another scam. Keep communication with the bank and authorised investigators rather than paying an unknown “recovery agent”.

Sources: RBI: reporting unauthorised electronic transactions ↗ · Home Ministry: financial cyber fraud helpline 1930 ↗ · National Cyber Crime Reporting Portal ↗

Build an incident record that can be followed

Record the time, amount, bank or wallet, transaction reference and the account or identifier shown in the transaction. Preserve relevant messages, phone numbers, website addresses and screenshots. Keep originals; do not delete the conversation in anger or continue sending money to test the fraudster.

For example: “At 11.05 am I received a call claiming to be a refund desk; at 11.12 am ₹4,000 left my account through transaction [reference].” Add the reporting times and complaint numbers. This chronological account helps distinguish the initial contact, payment and steps already taken, without burying them in unrelated personal history.

Sources: Cybercrime portal: information to prepare for a complaint ↗ · National Cyber Crime Reporting Portal ↗

Support the person and practise before a crisis

If helping a relative, begin with “Let us report this and secure the account.” Blame and humiliation can delay disclosure and make future problems harder to discuss. Sit alongside them while they contact the bank; do not take over their identity or collect their PIN.

Build a small preparation routine: save official contacts, review transaction alerts and practise saying “I will check independently before doing anything.” Teach one concept at a time using a fictional example, without making a real payment. The aim is confident use of digital services with a clear pause-and-check habit, not fear of every online task.

Sources: RBI: safeguards for digital banking ↗

PUT IT INTO PRACTICE

Put the lesson into practice

For a fictional refund call, underline the claimed identity, pressure and requested action.
Explain to someone why a payment PIN is not needed simply to receive an ordinary UPI transfer.
Prepare a blank incident record and save your bank’s official contact, 1930 and the official portal address.

Check your understanding

A caller knows my name. Does that prove they work for my bank?

No. Personal details can be obtained from many places. Verify through a contact you find independently, not through the caller’s own link or number.

Why is a QR-for-refund story suspicious?

A payment QR plus PIN can authorise money leaving your account. Read the actual action and recipient shown in your app instead of following the caller’s description.

Should I wait until tomorrow to report a loss?

Report promptly to the bank and 1930 and follow the official portal process. Delay can reduce the opportunity to interrupt further movement of funds.

Is a recovery fee a guarantee that money will return?

No. Treat guaranteed recovery claims with caution and stay with official channels. Paying an unknown intermediary can create an additional loss.