CyberPortalHub — Cyber Safety Awareness Library

How to Report Online Financial Fraud on the National Cyber Crime Portal (1930)

Online financial fraud can happen within minutes through UPI, internet banking, cards, wallets, investment platforms, impersonation calls, fake customer-care numbers and other social-engineering methods. The most important response is speed. In India, the National Cyber Crime Reporting Portal provides an online reporting route and the national cyber-crime helpline 1930 is available for immediate reporting of cyber financial fraud. This guide explains what to do, what information to keep ready, and why a victim should not wait for the scammer to contact them again.

Why immediate reporting matters

A digital payment creates a transaction trail, but money can move rapidly through multiple accounts, wallets or payment channels. Reporting quickly gives the banking and law-enforcement ecosystem an opportunity to examine the transaction and take action under the applicable process. A report is not a guarantee that money will be recovered, but delay can reduce the practical opportunity to intervene. Do not spend time negotiating with the fraudster, trying to recover the money yourself, or deleting messages.

Step 1: Contact 1930

If you have suffered a cyber financial fraud, call 1930 as soon as possible. Keep your mobile phone, bank or wallet information and transaction details available. The official portal identifies 1930 as the immediate reporting number for cyber financial fraud and states that it operates 24×7. Tell the operator the facts clearly: when the incident happened, how the fraud occurred, the amount involved, the bank/wallet/merchant concerned and the transaction reference.

Step 2: File the online complaint

Visit the official National Cyber Crime Reporting Portal and select the financial-fraud reporting route. Register using the information requested by the portal and provide an accurate incident description. The portal's current checklist asks complainants to keep the incident date and time, incident details, identity proof, bank/wallet/merchant name, 12-digit transaction ID/UTR, transaction date, fraud amount and relevant evidence ready. Follow the fields shown on the live portal because categories and screens can change.

Evidence you should preserve

Save bank SMS alerts, account statements, UPI transaction details, screenshots, email headers, phone numbers, WhatsApp or Telegram conversations, website addresses, social-media profiles, QR codes, payment links and recordings that you lawfully possess. Do not crop or edit the original evidence unnecessarily. If you need to make a working copy for your own notes, retain the original separately. Note the exact date and time and write a short chronological timeline while the events are fresh.

Inform your bank or payment provider

In parallel with the cyber-crime report, immediately contact the bank, card issuer, wallet or payment service involved through its official customer-support channel. Explain that the transaction is disputed or fraudulent and ask for the appropriate complaint or dispute process. Use only contact details from the institution's official website, app, card or statement. Do not use a customer-care number found in a random search result, social-media comment or message.

What not to do

Do not pay a second amount to a person claiming that it will unlock, refund or reverse the first transaction. Do not share OTPs, UPI PINs, card PINs, passwords or remote-access codes with anyone claiming to be a police officer, bank employee or recovery agent. Do not install an app merely because a caller tells you it is needed to process a refund. Keep communication with the suspect as evidence, but do not attempt a private investigation that could expose you to further loss.

After reporting

Record the complaint or acknowledgement reference provided by the official systems. Monitor your bank accounts and linked payment instruments for additional unauthorized activity. Change compromised passwords and revoke suspicious sessions where applicable. If your SIM, email or social-media account is also compromised, secure those accounts immediately. If the incident involves identity documents, report the relevant misuse through the appropriate official service as well.

Frequently asked questions

Can I report after several days? You should report as soon as possible; do not avoid reporting merely because some time has passed. Can 1930 guarantee a refund? No. It is a reporting and response mechanism, not a guarantee of recovery. Should I use third-party websites that promise recovery? Be very cautious. A person who asks for an advance fee to recover your fraud money may be attempting a second scam. Always verify official channels.

Create a simple incident timeline

Write the incident as a timeline before submitting the complaint. Start with the first call, message, advertisement or website that led to the fraud. Then record each important action: when you clicked a link, entered information, approved a UPI payment, shared a card detail, transferred money, received a suspicious call, or discovered the loss. Include the exact date and approximate time. A short factual timeline can make the complaint easier to understand and can prevent important details from being forgotten when you are stressed.

Protect the rest of your finances

After a financial fraud, do not focus only on the transaction that has already happened. Check whether the same mobile number, email account, card, UPI profile or banking credentials are connected to other financial services. Change exposed passwords, disable compromised cards where appropriate, and review recent transactions. If a fraudster obtained remote access to a device, treat other accounts used on that device as potentially exposed and secure them from a trusted device.

Understand the role of the complaint

The National Cyber Crime Reporting Portal is a reporting mechanism. It does not mean that a complaint automatically results in recovery of money or identification of a suspect. Recovery and investigation depend on the facts, transaction trail, available evidence, actions by banks and intermediaries, and lawful investigation. Avoid websites or individuals promising guaranteed recovery for an advance fee. A second payment made to a fake recovery agent can increase the loss.

Useful evidence checklist

Keep the original transaction confirmation, bank statement or payment receipt; screenshots of the suspect's profile; phone numbers; email addresses; website URLs; UPI IDs; account details shown to you; chat exports where available; and any advertisement or job/investment material. Preserve the files in their original form. Do not edit screenshots in a way that removes relevant context. If you make a redacted copy for sharing publicly, keep the unredacted original safely.

When to seek additional help

For an active financial fraud, use 1930 promptly and follow the official online reporting process. If there is a threat, extortion, identity misuse, stalking, account takeover or another serious offence, preserve the evidence and contact the appropriate law-enforcement authority. For banking disputes, use the bank's official grievance mechanism as well. Different parts of one incident may require different reporting channels.

Final prevention checklist

Before making another online payment, independently verify the recipient, purpose and amount. Never disclose an OTP, UPI PIN, card PIN or password because a caller creates urgency. Avoid remote-access applications requested by strangers. Keep banking alerts enabled, update your phone and apps, and use official websites for customer support. Most importantly, if something feels urgent and confusing, pause the transaction and verify it through a separate trusted channel.

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

Step-by-Step Guide: How to Secure Your WhatsApp from Hacking & SIM Swap

WhatsApp security depends on more than a strong password. A criminal may attempt to take control of an account by obtaining a verification code, manipulating a SIM replacement, tricking a victim into linking a device, or gaining access to the phone itself. The safest approach is to protect the mobile number, the WhatsApp account, the device and the recovery channels together.

Start with the mobile number

Your mobile number is an important identity and recovery channel. Never share an SMS verification code with another person. If your phone suddenly loses network service without an obvious reason, contact your telecom operator using an official channel. A sudden loss of service can have several causes, but it can also be a warning sign that deserves prompt checking.

Enable WhatsApp two-step verification

Open WhatsApp settings and locate the account security option for two-step verification. Set a PIN that is not reused elsewhere and add a recovery email address if the current WhatsApp interface offers the option. The exact menu wording can differ by Android or iPhone version, so use the latest WhatsApp interface rather than an old screenshot.

Review linked devices

Periodically review WhatsApp's linked-device list. If you see a browser or computer you do not recognise, remove it and change your security settings. Never scan a QR code for linking a device when an unknown person is guiding you over a call or chat. Treat unexpected QR-code requests as suspicious.

Protect your SIM

Use a SIM PIN where supported by your device and operator, and keep your telecom account information private. If you receive an unexpected SIM-replacement message, or the original SIM stops working unexpectedly, contact the operator immediately through an official channel. Check Sanchar Saathi for telecom-security services and use the appropriate reporting route if you suspect misuse.

Protect the phone itself

Use a strong screen lock, keep the operating system updated, install apps only from trusted stores, and avoid unknown APK files. A compromised phone can undermine otherwise good account-security settings. Review app permissions and remove applications you no longer need.

Recognise common social-engineering tricks

Attackers may claim to be a friend, police officer, bank employee, telecom worker, courier company or WhatsApp support representative. They may create urgency by saying your account will be closed or a parcel is linked to a crime. Do not disclose verification codes, passwords or remote-access details because of pressure.

If you think the account is compromised

Warn your contacts through another channel so they do not trust unusual messages from your account. Try the official WhatsApp registration/recovery flow. If a SIM-swap is suspected, contact the telecom operator and secure banking accounts linked to the number. If money or identity information was lost, report the incident through the appropriate official cyber-crime channel.

Practical checklist

Enable two-step verification; review linked devices; never share verification codes; protect the SIM; update the phone; avoid unknown apps; use a screen lock; review privacy settings; keep recovery email access secure; and act immediately when service or account behaviour changes unexpectedly.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

How to Check How Many Mobile SIM Cards Are Issued in Your Name (TAFCOP)

A mobile connection issued in your name is not just a telecom matter. An unknown connection can create identity, financial and legal complications if it is misused. The Department of Telecommunications provides the Sanchar Saathi ecosystem, including the service commonly known as TAFCOP, through which users can check mobile connections associated with their identity records and take the appropriate action for numbers they do not recognise.

What TAFCOP is for

TAFCOP is designed to help mobile subscribers know the connections issued in their name. The service is part of Sanchar Saathi. It should not be confused with CEIR, which deals with lost or stolen mobile handsets. Checking your connections periodically can help you notice numbers that you no longer use or do not recognise.

Open the official service

Use the official Sanchar Saathi domain and the TAFCOP service address shown above. Avoid lookalike websites with similar spellings, advertisements or unofficial domains. A genuine government service should be accessed from its official domain. Do not enter your OTP on a third-party website.

Login and verify

The service uses mobile-number verification. Enter the mobile number requested by the official portal and complete the OTP verification process. The exact interface can change, so follow the instructions displayed on the live government portal.

Review every listed connection

Go through the displayed mobile connections carefully. Do not assume that every number you see is fraudulent merely because you do not remember it immediately. Consider old numbers, family arrangements and connections that may have been legitimately obtained. If a connection genuinely does not belong to you, use the action/reporting option provided by the official service.

If you find an unknown number

Follow the portal's current process for reporting a number that is not yours or is no longer required. Save the acknowledgement or reference details if provided. If you believe the connection is part of a larger identity-fraud or cybercrime incident, also consider reporting the matter to the appropriate law-enforcement authority.

Why this matters for cyber safety

Fraudsters sometimes need telecom identities to receive calls, OTPs or communications. The government has repeatedly advised citizens not to procure SIM cards fraudulently or hand over SIMs obtained in their name for misuse. Regularly checking your connections is therefore a sensible identity-hygiene practice.

Avoid common mistakes

Never pay an unofficial person to 'remove' a SIM from your name. Never give an OTP to a caller claiming to be from TAFCOP or DoT. Do not use a search-engine result without checking the domain carefully. Do not publish screenshots containing your mobile number, OTP or other sensitive details.

A simple monthly or quarterly habit

Set a reminder to review telecom connections periodically, especially after losing a SIM, changing operators, closing a business number or discovering suspicious activity. Combine the check with a review of banking alerts, email recovery settings and important account sessions.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

How to Block & Trace Lost or Stolen Mobile Phones via CEIR

Losing a smartphone is more serious than losing a physical object because the device may contain personal photographs, messages, authentication sessions, contacts and payment applications. India's Central Equipment Identity Register (CEIR), available through Sanchar Saathi, provides a mechanism for blocking lost or stolen mobile handsets and checking the status of a request. The correct process begins with a police report and preparation of the required documents.

First actions after loss

Move quickly. Try the device-location and remote-lock features provided by your phone ecosystem if they were enabled. Contact your telecom operator to secure the SIM and obtain a re-issued SIM where appropriate. Change critical account passwords from a trusted device if the lost phone contained active sessions.

File a police report

The current CEIR blocking guidance asks users to have a police report/FIR copy for a lost or stolen handset. Keep the report safely because it may be required during the online blocking process and for subsequent follow-up.

Get a re-issued SIM

CEIR's current prerequisites state that a re-issued or duplicate SIM for the lost mobile number is needed because the number is used for OTP verification. Make sure SMS service is active as required by the operator.

Keep documents ready

The CEIR portal lists a valid identity proof and the IMEI number among the information to keep ready. A purchase invoice is optional if available. If your phone supports more than one IMEI, retain both where applicable.

Submit the blocking request

Open the official CEIR portal and choose the service for blocking a lost or stolen mobile. Complete the form carefully, attach the requested documents and submit it. The portal provides a Request ID that can be used to check status and for future unblocking when the device is recovered.

Tracing and recovery

Blocking a handset through CEIR is not the same as physically locating it yourself. The system can help prevent use of the blocked device on mobile networks and can support lawful tracing/recovery processes. If the phone is recovered, follow the official unblocking process and coordinate with the police as appropriate.

Protect accounts on the lost phone

Immediately review email, banking, payment and social-media sessions from another trusted device. If your authenticator or recovery codes were stored on the phone, follow the relevant provider's account-recovery procedure. Do not wait for evidence of fraud before securing high-value accounts.

Verify a phone before buying second-hand

CEIR also provides a handset-genuineness facility. The portal states that users can check a device using its IMEI and warns against buying a handset shown as blacklisted, duplicate or already in use. Verify before paying for a second-hand device.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

Understanding Digital Arrest Scam: How to Protect Yourself from Fake Police Calls

A digital-arrest scam uses fear, impersonation and urgency. The caller may claim to be from the police, CBI, RBI, Enforcement Directorate, telecom authorities or another government organisation and may accuse the victim of involvement in a serious crime. The victim may then be kept on a prolonged video call and pressured to transfer money. I4C has issued an advisory describing this pattern and clearly stating that there is no concept of 'digital arrest' under Indian law.

How the scam begins

A victim may receive an unexpected call alleging that a parcel, SIM, bank account or identity document has been linked to illegal activity. The caller may use official-looking language, fake case numbers, uniforms, logos, video backgrounds or multiple people acting as officials.

The intimidation stage

The scammer tries to stop the victim from thinking independently. They may say that speaking to family, a lawyer or bank will worsen the case. They may threaten immediate arrest, account freezing or public embarrassment. This pressure is a core part of the fraud.

The fake video investigation

Some victims are told to remain continuously on a video call. The scammer may create a fake police-station environment and instruct the victim to show identification documents, bank balances or screens. The appearance of an official process does not make the call genuine.

The money demand

The scam may progress to a demand for 'verification', 'security deposit', 'bail', 'settlement' or transfer to a 'government account'. Do not transfer money because of an unverified demand. A genuine legal process should not be validated by blindly following instructions from an unsolicited caller.

What I4C says

The I4C advisory dated 6 March 2025 describes digital-arrest complaints and states that real law enforcement does not arrest people digitally. It also states that there is no concept of digital arrest under Indian laws. Use the advisory as an awareness reference, not as a substitute for legal advice.

What to do during the call

Stay calm. Do not share OTPs, PINs, passwords or banking details. Do not install remote-access software. End the call if necessary and independently verify the alleged organisation through an official website or known contact channel. Tell a trusted person what happened.

If money has already been sent

Contact your bank/payment provider immediately and report cyber financial fraud through 1930 and the National Cyber Crime Reporting Portal. Preserve the phone number, chat history, payment details, screenshots and recordings that you lawfully possess.

Red flags to remember

Unexpected criminal allegations, demands for secrecy, urgent money transfers, requests to remain on video, requests for remote access, threats of immediate digital arrest and instructions to move money for 'verification' are strong warning signs. The safest response is independent verification, not compliance with pressure.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

UPI Fraud Prevention: Common Tricks Used by Scammers & Safe Practices

UPI makes payments fast, but the same speed can help a scam succeed when a user is pressured into approving a transaction. Most prevention depends on understanding the difference between receiving money and authorising a payment. NPCI's fraud-awareness guidance highlights fake cashback links, QR-code misuse, unknown apps, fake investment schemes, threats and other social-engineering methods.

Understand the UPI PIN

A UPI PIN authorises a payment from your account. It should not be entered merely because someone says you need it to receive a refund or cashback. NPCI's fraud-awareness material specifically warns that scanning a QR code and entering a UPI PIN is for making payments, not receiving money.

QR-code scams

A scammer may send a QR code and claim that scanning it will add money to your account. In reality, the QR flow may be designed to initiate a payment. Always read the payment screen carefully before entering the PIN.

Fake cashback and refund offers

Fraudsters may imitate a merchant, bank or payment app and promise a refund. They may send a link or ask you to approve a collect request. Verify refunds through the merchant's official app or website rather than through a caller's instructions.

Remote-access and screen-sharing fraud

A scammer may ask you to install an app so they can 'help' with a failed payment. This can expose OTPs, screen contents or sensitive information. Never give an unknown person control of your device.

Investment and trading scams

Fraudulent investment groups may display fake profits and later demand additional deposits. A polished app or Telegram group does not prove legitimacy. Verify the financial service independently before transferring money.

What to do before every payment

Check the recipient name, UPI ID, amount and purpose. Never approve a transaction simply because the other person says it is urgent. If a request is unexpected, stop and verify through a separate channel.

If a fraudulent transaction occurs

Immediately notify the bank/payment provider and report cyber financial fraud through 1930 and the official National Cyber Crime Reporting Portal. Preserve the transaction ID/UTR and screenshots.

Daily UPI safety habits

Keep the UPI app and phone updated, use a secure screen lock, avoid unknown apps, do not share PINs or OTPs, review transaction alerts, and use official customer-support channels. A few seconds of verification can prevent a costly mistake.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

How to Spot Fake Part-Time Job, Work-From-Home & Telegram Scams

Fake job scams often begin with an attractive offer: simple tasks, high income, flexible hours or a promise of guaranteed returns. The victim may first receive a small payment to build trust and is later asked to deposit larger amounts for tasks, membership, security, withdrawal, taxes or upgrades. Cybercrime advisories have also highlighted fake job rackets and fake CAPTCHA-filling jobs.

The basic pattern

A stranger contacts you through WhatsApp, Telegram, SMS or social media and offers easy online work. The message may contain a job title, salary figure and a link. After initial interaction, the victim is moved to a private group or fake platform.

The trust-building phase

Scammers may show fake success stories, fake dashboards and screenshots of withdrawals. They may pay a small amount initially. This does not prove that the opportunity is genuine; it can be part of a deliberate trust-building strategy.

The deposit trap

Eventually the victim is asked to deposit money to unlock a task, complete an order, increase a level, release earnings or withdraw a larger balance. Once the victim pays, new charges may appear. Legitimate employment should be independently verified before money is sent.

How to verify an employer

Search for the organisation's official website and contact information independently. Check whether the vacancy exists on the company's official careers page. Verify the domain spelling. Be cautious if recruitment is conducted entirely through a random messaging account and the recruiter refuses a normal interview.

Never pay for a guaranteed job

A demand for payment should be treated as a major warning sign, particularly when the recruiter promises guaranteed earnings. Do not send identity documents, bank credentials or selfies until the organisation and purpose are verified.

Telegram-specific warning signs

Large groups, fake administrators, urgency, investment-style tasks, anonymous payment instructions and disappearing messages can make scams difficult to verify. Treat group membership or testimonials as unverified claims, not proof.

If you already paid

Stop further payments. Save the complete conversation, transaction details, account numbers, UPI IDs, URLs and usernames. Contact the bank/payment provider and report financial cyber fraud through 1930 and the National Cyber Crime Reporting Portal.

A safer job-search checklist

Verify the company, verify the job listing, interview through a normal channel, never share OTP/PIN, never install unknown apps, never pay to unlock wages, and do not let urgency replace verification.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

How to Safely File an Online Cyber Crime Complaint in India

The National Cyber Crime Reporting Portal is the Government of India's online mechanism for reporting cybercrime. It covers categories including online financial fraud, mobile-related crimes, social-media crimes, ransomware, hacking, cryptocurrency-related crimes and other cyber offences. A well-prepared complaint helps the receiving authority understand what happened and what evidence exists.

Choose the official portal

Always type the official domain yourself or use a trusted bookmark. The portal provides routes for women/children-related crimes, financial fraud and other cybercrimes. Do not submit sensitive information on unofficial sites that imitate government branding.

Prepare before starting

The current portal checklist asks for incident date and time, incident details, identity proof and relevant evidence. For financial fraud, it asks for bank/wallet/merchant name, transaction ID/UTR, transaction date and fraud amount. Having these ready reduces mistakes.

Write a clear incident timeline

Start with the first contact. Record the platform used, phone number or username, what the suspect said, what action you took, the payment or account event, and what happened afterwards. Use simple factual language and avoid unsupported conclusions.

Upload useful evidence

Keep screenshots, statements, emails, URLs, profile links, transaction records and other relevant material. Preserve originals. If an image is blurry, provide the original rather than repeatedly compressing it.

Avoid exaggeration

A complaint is more useful when it distinguishes what you know from what you suspect. For example, say 'I received a call from this number' rather than asserting an unverified identity. Provide exact dates, amounts and references where possible.

Track the complaint

Use the official tracking facility and keep the acknowledgement/reference number. If the portal provides a grievance or nodal-officer mechanism for the relevant issue, follow the current instructions displayed there.

Financial fraud requires speed

If money has been lost, do not wait until the online form is completed before taking urgent action. The official portal directs victims of cyber financial fraud to call 1930 for immediate reporting.

Protect yourself after filing

Change compromised passwords, secure the SIM, notify the bank, warn contacts if an account was hijacked, and avoid people who promise guaranteed recovery for an advance payment. Keep copies of your complaint and evidence.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

Essential Privacy Settings You Should Enable on Instagram & Facebook

Social-media privacy is not a single switch. It is a combination of account security, audience controls, messaging controls, login protection and careful sharing. Settings names and locations can change as platforms update their interfaces, so users should always compare the instructions with the current Meta Help Centre.

Secure the login first

Enable two-factor authentication and review login/security alerts. Meta's security guidance describes login alerts and two-factor authentication as security features that add protection to accounts. Use a strong, unique password and avoid reusing the same password on email or banking services.

Review active sessions

Periodically review where your account is logged in. Remove devices or sessions you do not recognise. If you suspect compromise, change the password and use the platform's account-recovery process.

Control who sees your posts

Use privacy and audience controls deliberately. Not every post needs to be public. Review older public posts and remove unnecessary personal details such as phone numbers, home information, travel plans or identity documents.

Protect stories and messages

Review who can reply to stories, send message requests, tag or mention you. Restricting unknown accounts can reduce spam and social engineering.

Limit personal information

Avoid posting photographs of tickets, IDs, addresses, school details, vehicle documents or other information that can help an attacker build a convincing impersonation.

Beware fake support messages

Attackers may pretend to be Meta support and ask you to click a link or provide a login code. Use the platform's official Help Centre and in-app account notifications to verify security issues.

If the account is hacked

For Facebook, Meta directs users with hacked accounts to https://www.facebook.com/hacked, preferably from a device previously used to log in. Instagram provides account-recovery guidance through its Help Centre and may use additional identity checks in some situations.

Make privacy a routine

Review security and privacy settings after major platform updates, after changing your phone number or email, and whenever you notice unexpected login notifications. Security settings are most useful when they are checked before a problem occurs.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

Phishing Links & Fake Websites: How to Identify Safe URLs

A phishing website can look almost identical to a bank, government portal, courier company, shopping website or social network. The goal is usually to make a person disclose credentials, card information, OTPs or other sensitive information. The safest approach is to verify the destination independently instead of trusting the appearance of a page.

Check the domain, not just the logo

Look at the complete domain name in the browser address bar. A page can copy an official logo and design while being hosted on an unrelated domain. Government services commonly use official government domains, but users should still verify the exact address.

Watch for spelling tricks

Attackers may use extra words, misspellings, hyphens or look-alike domains. A secure connection icon does not prove that a site is legitimate; HTTPS protects the connection but does not certify the honesty of the website owner.

Avoid login links from unexpected messages

If an SMS says your bank account will be blocked, do not click its link immediately. Open the bank's official app or type the official website address yourself. The same approach applies to government portals, email services and social networks.

Understand shortened URLs

Short links can hide the final destination. When the source is unknown, do not open the link just to find out where it goes. Verify through a trusted source first.

Never disclose OTPs and PINs

A genuine service should not require you to disclose a banking OTP, UPI PIN or password to a caller. If a website asks for unusual information, stop and verify.

Use official apps and bookmarks

For services you use frequently, save the official website as a bookmark or use the official app from a trusted app store. This reduces the chance of clicking a malicious advertisement or message.

If you clicked a phishing link

Do not panic. If you entered credentials, change the password immediately from a trusted device and review active sessions. If banking information or money was involved, contact the bank and report the cyber incident through the appropriate official channel.

CERT-In guidance

CERT-In advises users to verify the legitimacy of links and emails, consider spelling and grammar in URLs, avoid entering sensitive information on sites that do not use HTTPS, and download apps only from official app stores. HTTPS alone, however, should never be treated as proof that a site is genuine.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

What to Do Immediately If Your Credit or Debit Card Is Compromised

Card compromise requires quick containment. A suspicious transaction, a lost card, a phishing page, or a message asking for card details can all expose payment credentials. The safest response is to stop further use, contact the card issuer through an official channel, preserve transaction evidence and report cyber fraud when applicable.

Block first, investigate second

If you see an unauthorised transaction or believe card details have been exposed, use the bank's official app or support channel to block or disable the card. Do not wait for a second transaction before acting.

Record the incident

Write down the time you noticed the problem, the transaction amount, merchant name, last four digits of the card and any relevant alert message. Keep the original SMS/email.

Contact the issuer

Use the number printed on the card, the bank's official website or official app. Ask about the dispute process, card replacement and whether other payment instruments need to be secured.

Secure the account

Change credentials if you entered the card information on a suspicious site. Review recent logins and transactions. If the email linked to the account is compromised, secure the email too.

Beware recovery scams

A fraud victim may receive calls from fake bank investigators offering an immediate refund. Never share an OTP, PIN, CVV or remote-access permission with such callers.

Report financial cyber fraud

If money has been lost through a cyber-enabled fraud, contact the bank/payment provider and report promptly through 1930 and the National Cyber Crime Reporting Portal.

Preserve evidence

Keep screenshots, URLs, payment references, call details and messages. Do not delete the conversation with the suspected fraudster until you have safely preserved relevant evidence.

Prevent recurrence

Use transaction alerts, review statements, avoid unknown shopping sites, use official apps and never enter card credentials into a page reached through an unsolicited message.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

How to Safeguard Your Banking Details While Using Public Wi-Fi

Public Wi-Fi is convenient in airports, hotels, cafés, stations and other shared spaces, but convenience should not override security. The safest approach is to avoid sensitive financial activity on untrusted networks whenever practical and to rely on trusted mobile data or a secured network for banking and other high-value transactions.

Why public networks need caution

You may not know who operates a public hotspot, how it is configured, or whether another network with a similar name is legitimate. Attackers can also use social engineering to make users connect to a fake hotspot.

Avoid sensitive banking activity

CERT-In guidance has advised against using public Wi-Fi networks for accessing email, online banking, credit-card accounts or other sensitive information. If the transaction can wait, use a trusted network.

Prefer mobile data

When you need to perform a banking transaction while away from home, mobile data from your own device can be a safer practical option than an unknown hotspot. Keep the device updated and protected with a screen lock.

Do not disable security warnings

Never ignore browser certificate warnings just because you are trying to reach a bank or government portal. Stop and verify the address. A security warning can indicate a configuration problem or a more serious interception attempt.

Protect banking credentials

Use strong passwords, unique credentials and two-factor authentication where offered. Never share OTPs, card PINs, CVVs or UPI PINs with anyone.

Watch for fake captive portals

Some public networks ask users to sign in through a web page. Do not enter banking credentials into a Wi-Fi login page. If the page asks for unusually sensitive information, disconnect and verify.

After using public Wi-Fi

Disconnect when finished and forget the network if you do not need it again. Review important account activity if you performed any sensitive action. Avoid saving passwords on shared devices.

What to do after suspected exposure

If you believe banking credentials were exposed, contact your bank through an official channel, change credentials as appropriate and monitor transactions. If money is lost through cyber fraud, report immediately through 1930 and the National Cyber Crime Reporting Portal.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

How to Lock Your Aadhaar Biometrics Online for Extra Security

UIDAI provides a Biometric Lock/Unlock service intended to strengthen the privacy and confidentiality of Aadhaar biometric data. UIDAI's current information states that fingerprint, iris and face biometric modalities can be locked, and that biometric authentication cannot be performed while the biometrics are locked. This guide explains the concept and how to use the official Aadhaar services safely.

What biometric locking does

UIDAI explains that biometric locking prevents Aadhaar authentication using the locked biometric modalities. The service is a security control for Aadhaar authentication and should be understood separately from other Aadhaar services such as downloading Aadhaar or checking authentication history.

What you need

UIDAI states that a registered mobile number is essential for the biometric lock/unlock service. If your mobile number is not registered with Aadhaar, follow UIDAI's current process for updating it at an authorised centre or through an available official service.

Use the official portal

Start from UIDAI's official website or MyAadhaar portal. Avoid websites that imitate UIDAI or ask you to pay unofficial fees. Check the domain before entering Aadhaar-related information.

Find Lock/Unlock Biometrics

Use the current MyAadhaar interface to locate the Biometric Lock/Unlock service. The wording and layout may change as UIDAI updates its portal. Follow the live instructions displayed on the official website.

Authentication and unlock

UIDAI states that biometric locking can be temporarily unlocked or the locking system can be disabled by the Aadhaar holder. Use the official authentication method displayed by UIDAI and do not disclose OTPs to another person.

What happens while locked

UIDAI states that fingerprint, iris and face biometric authentication will be blocked when the biometric lock is active. An authentication attempt using a locked biometric modality produces the specified error code indicating that biometrics are locked.

Do not confuse biometric lock with Aadhaar lock

UIDAI also provides a separate Aadhaar UID Lock/Unlock mechanism. These are different controls. Biometric locking concerns biometric authentication, while UID locking restricts authentication using the Aadhaar number and related mechanisms described by UIDAI.

Good Aadhaar-security habits

Use the official UIDAI website, protect your registered mobile number, avoid sharing Aadhaar documents unnecessarily, use masked Aadhaar where appropriate, review authentication history when needed, and never share OTPs with callers claiming to be UIDAI officials.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

Safe Online Shopping: How to Spot Scam E-Commerce Websites

Online shopping scams can involve fake stores, counterfeit products, cloned websites, unrealistic discounts, fake customer-care numbers and payment links that redirect customers to unrelated accounts. A professional-looking website is not enough to establish legitimacy. Safe shopping requires independent verification before payment and careful review of the seller, domain and transaction.

Check the website address

Look at the exact domain before creating an account or paying. Be cautious of spelling variations, unexpected subdomains and domains that imitate well-known brands. HTTPS is useful for encrypted communication but does not by itself prove that a shop is genuine.

Be sceptical of extreme discounts

A price far below the normal market range can be a warning sign, especially when combined with urgency such as 'pay in ten minutes' or 'last two units'. Compare the product on the brand's official site and established marketplaces.

Verify contact information

Check whether the seller provides a physical address, customer-support details, refund policy, terms and other basic business information. Verify contact details independently instead of trusting only a phone number displayed on the site.

Use safer payment methods

Prefer payment methods that provide appropriate consumer protections and keep records. Do not transfer money to a personal account merely because a seller says the website's payment gateway is unavailable.

Watch for fake customer support

Scammers sometimes buy advertisements or post fake support numbers. Always obtain customer-care details from the merchant's official app, website or statement rather than a random social-media post.

Check before downloading an app

Do not install an APK sent through WhatsApp or Telegram to receive a shopping discount or refund. Use official app stores and verify the developer and app information.

If the product never arrives or money is stolen

Keep the order page, invoice, payment reference, messages and seller information. Contact the payment provider and merchant through official channels. If the matter involves cyber fraud or unauthorised payment, report it through the appropriate official cybercrime channel.

A practical shopping checklist

Verify domain; compare price; check seller identity; read refund terms; use official apps; avoid unknown APKs; do not share OTP/PIN; keep receipts; and monitor your payment account after purchase.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.

How to Recover Hacked Social Media Accounts (Step-by-Step Guide)

When a social-media account is hacked, the attacker may change the password, email address, phone number, profile information or connected sessions. They may then contact friends for money or use the account for scams. Recovery should begin with the platform's official recovery tools rather than with third-party 'account recovery' services.

Recognise the signs

Warning signs include an unexpected password-change notification, unfamiliar login alerts, changed profile details, messages you did not send, new linked devices, or an email saying the account's contact information was changed.

Secure the email first

If the email account used for social-media recovery is compromised, secure it first. Change the email password, enable multi-factor authentication and review recovery methods. Otherwise an attacker may continue resetting the social account.

Use official recovery tools

For Facebook, Meta's Help Centre currently directs users who believe their account was hacked to facebook.com/hacked, preferably from a device previously used to log in. For Instagram, use the official Help Centre/account-recovery flow. Do not trust people who claim they can recover the account for an advance payment.

Check changed account details

If you regain access, immediately review the email address, phone number, password, two-factor authentication methods and linked devices. Remove anything you do not recognise.

Warn your contacts

If the attacker has sent messages from the account, tell friends and colleagues through another channel not to trust requests for money, OTPs, links or urgent help.

Look for financial or identity misuse

If the hacked account was used to collect money or impersonate you, preserve evidence. If money was transferred, contact the bank/payment provider and report financial cyber fraud through 1930 and the National Cyber Crime Reporting Portal.

Do not make recovery worse

Do not send verification codes to strangers. Do not install remote-control applications because someone promises to fix the account. Do not give your password to a 'recovery expert'.

Prevent a repeat

Use unique passwords, two-factor authentication, recovery email protection, login alerts and regular session reviews. Keep your phone and browser updated and avoid signing in through links received unexpectedly.

Consider a realistic situation related to this topic: a person receives an unexpected message, call, link, payment request, account alert or service instruction and is encouraged to act immediately. The safest response is to slow down and verify the request independently. Look for inconsistencies in the sender identity, website address, payment destination, urgency, unusual requests for confidential information and instructions that bypass normal procedures. A professional logo, a familiar name or a convincing conversation is not proof that the request is genuine. Verification should be done through the official website, official application or a contact method you already trust.

Practical example and warning signs

Keep a basic record of the incident without unnecessarily collecting or sharing sensitive information. Depending on the topic, useful records may include the date and time, phone number, email address, username, website URL, transaction reference, complaint number, device identifier, screenshots, invoices, notifications and relevant messages. Preserve original evidence and create separate copies if you need to redact information for public sharing. Never publish OTPs, passwords, UPI PINs, card PINs, CVVs or complete identity documents while asking for assistance online.

What information should be kept ready

Before entering personal information, check the domain carefully and confirm that the service belongs to the expected organisation. For Indian government services, prefer the official government domain and navigate from the department's main website where possible. Do not rely only on a search advertisement, social-media post, forwarded message or a website that copies government branding. If a procedure appears different from an older article, follow the instructions shown on the current official portal rather than an old screenshot. Interfaces and URLs can change over time.

How to verify an official service

Do not continue the interaction simply because you have already shared information or made a payment. Stop additional payments, contact the relevant bank, telecom operator, platform or service provider through an official channel, and secure related accounts. If the incident involves cyber financial fraud in India, use the National Cyber Crime Reporting Portal and the 1930 helpline promptly. Preserve evidence before deleting messages or resetting devices when doing so could destroy useful information. If the incident involves an immediate threat or other serious offence, contact the appropriate law-enforcement authority.

What to do if something has already gone wrong

A frequent mistake is searching for help only after a problem has become serious. Another is trusting a caller because the caller knows some personal information. Other mistakes include clicking a second link to 'verify' a refund, sharing an OTP with a supposed support agent, installing an unknown application, paying an advance recovery fee, or using an unofficial customer-care number. Avoid these shortcuts. When in doubt, close the message or call and start again from an independently verified official website or application.

Common mistakes to avoid

Turn cyber safety into a routine rather than a one-time activity. Keep operating systems and important applications updated, use strong unique passwords, enable multi-factor authentication where available, review important account sessions, monitor financial alerts and check telecom or identity-security services when appropriate. Before approving a payment or sharing information, ask three questions: Who is asking? Why do they need it? How can I verify that independently? If the answer is unclear, pause. A short delay is usually safer than an irreversible transaction.

Simple prevention routine

Safety note: This article is for general public awareness. Government portals and platform interfaces may change. Before entering sensitive information, verify that you are on the current official website or app.