CYBER SECURITY
Protect your money by protecting your digital life
General education for India · Reviewed
Your financial plan depends on more than saving and investing. Your email, phone and payment accounts are also part of its defences. A few repeatable habits can reduce risk, although no checklist makes an account fraud-proof.
Start with the accounts that unlock other accounts
Use a long, unique password for each important account, especially email. Turn on multi-factor authentication where available, keep recovery details current and review unfamiliar signed-in devices. Never approve an unexpected sign-in prompt. A password manager can help you avoid reusing passwords, but protect the manager itself and its recovery method carefully.
Treat an email account as a key to other services: an intruder may use it to reset passwords elsewhere. Avoid keeping passwords, recovery codes and financial documents together in an ordinary shared note. These are practical starting points, not a recommendation of a particular security product. See NIC's October 2026 cyber-security guidance on unique passwords, MFA and privacy settings.
Keep the device and the payment journey under your control
- Install operating-system, browser and app security updates. Use a screen lock and review app permissions you no longer need.
- Open your bank or payment app yourself. For a supposed account problem, use a contact number inside the official app or on a genuine statement, rather than a number supplied by the caller.
- Do not install an APK, screen-sharing tool or remote-control app at an unknown caller's request. Stop banking while anyone else can see or control the screen.
- Check the recipient and amount on the payment confirmation screen. A message, screenshot or familiar display name is not proof that money arrived in your account.
RBI's Consumer Awareness: Cyber Threats and Frauds explains common payment traps. A UPI PIN is not needed to receive money. Never share a PIN, password or OTP with someone claiming to help you receive a refund. A PIN may authorise an action other than the one the caller described: read the actual screen before approving anything.
Verify the request, not just the caller's story
A familiar logo, a polished website or a convincing voice is not enough. If someone asks for urgent money or access, end the call and contact the person or organisation independently. For a family emergency, call the relative on a number you already know. HTTPS protects the connection to a website; it does not prove that the business or the request is genuine.
Discuss a simple family rule before an emergency: nobody has to make an immediate payment merely because a caller demands secrecy. CERT-In describes impersonation, remote-support and investment scams in its online-scam advisory.
Make safety a small recurring habit
Once a month, review transaction alerts and statements, check recovery contacts and remove unused app access. Keep a separate, secure record of official support channels so that you are not searching in a panic. These are suggested routines, not official reporting deadlines.
For your financial plan: share only the information a recipient actually needs. Review exports before sending them, use the intended recipient's verified contact details and never include banking passwords or OTPs in a planning document. A backup protects against some loss of data; it does not reverse a fraudulent payment.
If you suspect money has already moved, start with the fraud-response checklist. General educational guidance, reviewed 11 November 2026.
General education, not personal investment, insurance, tax or legal advice. Examples are not quotes or promises. Check current rules and seek qualified help where needed.