Protect yourself from online fraud: the habits and your rights

Almost every online money fraud has one thing in common: it needs you to do something. Share a code, tap a link, install an app, or send money in a hurry. Stop that one step and the fraud usually fails. And if it still gets through, the law gives you real protection, as long as you move fast.

The five habits. These cover the large majority of tricks, from fake KYC messages to fake police calls.

1. Never share a code. Your OTP, UPI PIN, card PIN and CVV are keys, not information. No bank or app ever needs them from you. You also never need a PIN to receive money.

2. Distrust urgency. “Your account will be blocked today.” “A case has been filed against you.” Fear and rush are the scammer’s main tools, as in the digital arrest scam. Hang up, wait, and check through a channel you trust.

3. Find numbers yourself. Fake customer care numbers fill search results. Take the number from your bank’s official website, your card or your passbook, never from a search ad or a text message. Treat any link in a message as phishing until proven otherwise.

4. Turn on every alert. SMS and app alerts for each transaction are your early warning. You cannot report what you never see.

5. Report at once. Call your bank to block the card or account, then call 1930, the national cyber fraud helpline, and file a complaint at cybercrime.gov.in. Our step-by-step reporting guide shows exactly how.

Your rights if money is taken. RBI’s rules on unauthorised electronic transactions put a clear clock on your liability. The clock starts when the bank alerts you about the transaction.

If the fault lies with the bank, you pay nothing whenever you report. If a third party broke in and nobody was careless, reporting within three working days means zero liability. Wait four to seven working days and the cap is 5,000 rupees on a basic savings account, 10,000 on most savings accounts, and up to 25,000 on some current accounts and high-limit cards. After that, the bank’s own policy applies.

An illustration: someone uses your stolen card details for 40,000 rupees from a regular savings account. Report it on day two, and you should get it all back. Report it on day six, and you could still lose up to 10,000 rupees.

Did you know? RBI says the bank must put the disputed amount back in your account within 10 working days of your report, even while it investigates, and the burden of proving you were careless lies with the bank, not you. Check the current RBI rules before you rely on these timelines.

One honest caveat. If you shared your OTP or PIN yourself, the rules treat that as your negligence, and you can bear the loss until you report it. That is why habit one matters most.

The takeaway. Fraud usually needs your help, so never share a code and never act in a panic. If something slips through, report the same day to your bank and 1930. Speed is the difference between losing nothing and losing a lot.

More to read: safe habits on UPI, the KYC update scam, why your UPI PIN is never for receiving money, the SIM swap scam, fake customer care numbers, fake trading apps, and debit card vs credit card.