Digital Payment Safety in India: UPI, Card and Net Banking Fraud, Warning Signs, Limits and What To Do After a Scam

Digital payments are convenient, but they make fraud faster too. Most losses do not come from hacking a bank. They come from tricking a person into approving a payment or sharing a code. Knowing the common tricks and setting simple safeguards removes most of the risk. This guide lists them, explains your rights, and gives a response plan.

Rates, limits and rules change often. Treat figures as indicative and confirm them on the official source before you act.

The golden rules

• Never share OTP, PIN, CVV, password or full card number with anyone, including someone claiming to be from the bank, police or a courier.
• You never need a PIN to receive money.
• Genuine organisations do not create urgency through threats of arrest or account blocking.
• When in doubt, hang up and call the number printed on your card or on the official website.

Common scams

Safe settings

• Phone: screen lock, automatic updates, apps only from official stores and no screen-sharing apps unless you started the session with a verified provider.
• UPI: set sensible limits, use a strong PIN not tied to your birth date, and turn off auto-approval features you do not use. Read the UPI guide.
• Cards: enable transaction alerts, set limits for online, international and contactless use, and switch off what you do not need through the bank app.
• Net banking: type the bank's address yourself, use a unique password and two-factor authentication. See password generator and cyber security basics.
• Email and social media: use two-factor authentication.

Your liability under RBI rules

For unauthorised electronic transactions, if the fault lies with the bank or a third party and you report within three working days, your liability is generally zero. If the fault is yours, such as sharing credentials, you may bear losses until you report. Reports after seven working days may attract the bank's board-approved liability policy. Report quickly and keep evidence.

If you lose money: first hour checklist

1. Call 1930, the national cyber fraud helpline, and file a report at the National Cyber Crime Reporting Portal. Fast reporting can freeze funds before they are moved on.
2. Call your bank and block cards, UPI and net banking. Ask for the incident to be logged and note the complaint number.
3. Change passwords for email, banking and other critical accounts.
4. Take screenshots of messages, numbers, transaction IDs and apps involved.
5. Report phone numbers and websites to the relevant platforms.
6. File an FIR if advised by the police, and follow up with the bank in writing.
7. If the bank does not resolve it within 30 days, approach the RBI Integrated Ombudsman.

Protect the vulnerable

Older relatives and first-time users are targeted most. Help them set limits, keep a small separate account for daily UPI use, and agree a simple rule: any call about money gets a call back to a known number before anything is done. Read scam awareness and banking basics together.

Online shopping and selling

• Buy from known sites, check seller ratings, and prefer cash on delivery or card payments through the platform for unfamiliar sellers.
• When selling, confirm receipt in your bank account, not through screenshots.
• Be wary of heavy discounts and links shared on social media.

Staying alert

Review statements monthly, update contact details with your bank, and do not click links in unsolicited messages. Fraudsters rely on fear and haste, so slowing down is your best defence.

Quick self-check you can do today

1. Open your bank app and confirm that alerts are on for every transaction.
2. Set online and international card limits to the lowest you actually need.
3. Remove saved cards from shopping sites you rarely use.
4. Save your bank's real helpline number in your phone under its name.
5. Tell family members about the 1930 helpline and the rule about never sharing OTPs.

Ten minutes spent on these steps is worth more than any antivirus app.

Frequently asked questions

Do banks ask for OTP or PIN?

No. Never share them with anyone.

Which number do I call to report cyber fraud?

1930, and file at the National Cyber Crime Reporting Portal.

Will I get my money back after fraud?

It depends on the cause and speed of reporting. Prompt reporting within three working days improves your protection.

Is a digital arrest real?

No. Police and courts do not conduct arrests or demand money over video calls.

Should I use public Wi-Fi for banking?

Avoid it where possible.

How do I spot a fake customer care number?

Use only the number on your card, the official site or app of your bank.

Last reviewed 8 November 2026. Rates, limits and rules change, so confirm figures with the official source before you act.