Tools Explore credit cards

Financial safety

Financial safety: how to spot a scam and protect your money

Most money scams in India follow a few familiar patterns: pressure to act fast, a request for a code or PIN, or a fee to be paid before you get anything. Learn the patterns once and they become much easier to recognise.

By Aman Multani, Founding Partner & Editor · Published 25 September 2026 · Last verified 25 September 2026

Three rules that stop most frauds. A genuine bank, lender or payment app will not ask you to tell anyone, or send anyone, your OTP, PIN, CVV or password. Look up contact numbers yourself, from the official website or app. And be very wary of anyone who asks you to pay money before you can receive a loan, refund or reward.

Spot a scam · What never to share · If you have already shared or paid

Spot a scam

Most of these have been the subject of public warnings from the Reserve Bank of India (RBI) or the government. For each one: what it looks like, the red flags, and what to do instead.

Fake loan apps

What it looks like. An app or ad offering an instant loan with almost no checks. Some ask for access to your contacts and photos, then use them to harass you later.

Red flags. You cannot find which bank or NBFC is actually lending. The app wants your contact list, gallery or call logs. Money must be paid to a personal UPI ID or an unrelated account.

What to do instead. Borrow only from a bank, an RBI-registered NBFC, or an app that clearly names the regulated lender behind it. RBI’s 2025 digital lending rules require lending apps to stay out of your file and media, contact list and call logs, and loan repayments go straight into the lender’s own bank account. RBI also keeps a directory of digital lending apps on its website, so you can check whether an app really is linked to a regulated lender.

“Pay a processing fee first” loan offers

What it looks like. Your loan is “approved”, but a processing, insurance, GST or “file charge” must be paid before the money can be released. Then another fee appears, and another.

Red flags. The fee goes to an individual’s UPI ID or bank account. There is no written loan agreement or Key Fact Statement. The approval came before anyone checked your income or credit.

What to do instead. For most retail and MSME loans, a regulated lender must give you a Key Fact Statement (KFS) before you sign, setting out the fees and charges. Under RBI rules, a fee not shown in the KFS cannot be charged without your explicit consent. RBI also requires that any fee owed to a loan app or agent is paid by the lender, not collected from you. If someone wants money from you to “release” a loan, stop.

“Guaranteed approval”

What it looks like. “100% approval”, “loan even with a low CIBIL score”, “no documents needed”.

Red flags. A promise made before anyone has looked at your income, existing EMIs or credit report.

What to do instead. No one can honestly guarantee a loan before the lender has assessed you. Check what you can realistically borrow with our FOIR calculator, and apply directly with a regulated lender.

Fake KYC update messages

What it looks like. An SMS, WhatsApp message or call saying your account, card or wallet will be blocked unless you “update KYC” today, usually with a link or an app to install.

Red flags. Threats that your account will be frozen, blocked or closed. A link to click, or an app to install. A request for your OTP, card details or copies of your documents.

What to do instead. RBI’s advice is to contact your bank or financial institution directly to confirm any KYC request, using a number from its official website, and to ask your branch how KYC can be updated. Do not click the link.

Callers pretending to be your bank, lender or RBI

What it looks like. A confident caller who knows your name, and perhaps part of your card number, “verifying a suspicious transaction” or offering a limit increase or reward points.

Red flags. They ask you to read out an OTP or PIN, or say the RBI needs your account details. RBI has said plainly that neither it nor banks send communications asking for your bank account details for any purpose.

What to do instead. Hang up and call your bank yourself on the number printed on your card or shown on its official website or app.

Fake customer-care numbers

What it looks like. You search online for a bank’s, wallet’s or delivery company’s helpline, call the first number that appears, and a “support executive” offers to fix your problem.

Red flags. The number came from a search result, a social media post or a random website. The “executive” wants you to install an app, share a code, or make a small payment to “verify” your account.

What to do instead. RBI warns that contact numbers on internet search engines may be fraudulent. Take them only from the official website or app.

Screen-sharing and remote-access requests

What it looks like. “Please install this app so I can help you.” Screen-sharing or remote-access apps let the other person see your screen, and sometimes control your phone or computer.

Red flags. Anyone who needs to see your screen to “fix” a payment, refund or KYC issue.

What to do instead. Don’t install apps because a caller asks you to. With remote access, a fraudster can read your messages, including OTPs, while you are on the call. RBI lists remote access among the common ways fraudsters get at customers’ data.

Credit score “repair” offers

What it looks like. An agency promising to delete a “settled” or “written off” entry, or to raise your CIBIL score by a set number of points, for a fee.

Red flags. A guaranteed score increase, or a claimed “tie-up” with a credit bureau.

What to do instead. Accurate information cannot be removed for a fee. Genuine errors can be disputed directly with the credit bureau. Our guide to settled vs closed accounts explains the real process, and quotes what TransUnion CIBIL says about agents claiming to improve scores.

Suspicious links and lookalike websites

What it looks like. A link to a page that looks exactly like your bank’s login screen, a refund form, or a “you have won” offer.

Red flags. A web address that is slightly misspelled or unfamiliar. A link sent by SMS, WhatsApp or email that you were not expecting. A page asking for your login, card details or OTP.

What to do instead. Do not click links in unexpected messages. Type the bank’s address yourself, or use its official app. RBI’s advice is not to share sensitive information through unverified websites or apps.

The pattern behind almost all of these: urgency (“today, or your account is blocked”), secrecy (“don’t tell the bank”), a request for a code or PIN, or money you must pay before you receive anything. When you notice any of these, slow down and check through an official channel.

What never to share

These details are how you approve payments and log in. Anyone who has them can act as you. RBI’s advice is never to share your account login, password, PIN, UPI PIN, OTP or card details with anyone, whoever they say they are.

Keep privateWhy it matters
OTP (one-time password)An OTP is often the final step that approves a payment or a change to your account. Sharing it can let someone else complete that step.
UPI PINIt authorises money leaving your account. You never need it to receive money. RBI notes that receiving money does not require scanning a QR code or entering a PIN.
Debit / credit card PINIt lets someone withdraw cash or pay with your card.
CVVThe security code printed on your card, used to approve online card payments.
Net-banking login and passwordIt gives full access to your accounts.
Passwords in generalYour email and phone passwords often protect the accounts where your OTPs and password-reset links arrive.
Control of your screenScreen-sharing and remote-access apps can show another person everything on your phone, including OTPs as they arrive.

Aadhaar and PAN: share carefully, not never

Identity documents are different. Banks, lenders and other regulated entities are sometimes legitimately required to verify your identity. The rule is to share them only through verified channels, and only when genuinely required: the lender’s own branch, official app or website. Do not send them to an unknown person on WhatsApp or through a link.

  • RBI advises against sharing KYC documents, or copies of them, with unknown or unidentified individuals or organisations.
  • UIDAI advises treating Aadhaar with the same caution as a bank account or passport, never disclosing an Aadhaar OTP to an unauthorised entity, and using a Virtual ID (VID) in place of your Aadhaar number where it is accepted.
  • UIDAI also lets you lock your Aadhaar biometrics and review recent authentication history through its official website.

If you have already shared details or paid money

Act quickly. CreditBharosa cannot investigate cases or recover money, but these official channels can act.

  1. Money has left your account? Call 1930 or report at cybercrime.gov.in straight away. 1930 is the national cyber-crime helpline, available 24x7. The government’s financial-fraud reporting system exists so that fraud can be reported immediately, to try to stop fraudsters moving the money on.
  2. Tell your bank or payment app immediately, using its official helpline or app. Ask it to block your card, UPI or net banking if needed. Under RBI’s rules, how quickly you report an unauthorised transaction affects how much of the loss you may bear. Where you shared a PIN or OTP yourself, you can bear the entire loss until you report it, so do not wait. RBI has announced revised rules on customer liability, including compensation for some small-value frauds, which take effect from 1 January 2027.
  3. Secure your accounts. Change your passwords and PINs, and uninstall any screen-sharing or remote-access app you were asked to install.
  4. Aadhaar details misused? Lock your biometrics and check your authentication history on UIDAI’s official website, or call UIDAI on 1947.
  5. Your bank has not resolved it? If you get no reply within 30 days, or you are unhappy with the reply, you can complain to the RBI Ombudsman at cms.rbi.org.in, or call 14448 for help. The complaint must be filed within 90 days of that deadline or of the bank’s last reply, whichever is later.
  6. No money lost, but you got a suspicious call or message? Report it through the Chakshu facility on Sanchar Saathi. Chakshu is for suspected fraud attempts. Cases where money was actually lost go to 1930 or cybercrime.gov.in.
  7. An illegal lending app, or someone collecting deposits without authorisation? RBI has advised reporting unauthorised lending apps to law-enforcement agencies or on its Sachet portal. Sachet is also where you can report illegal collection of deposits. You can report on cybercrime.gov.in too.

Keep screenshots, phone numbers, UPI IDs and transaction references. Be wary of anyone who contacts you afterwards offering to get your money back for a fee.

Official sources

Every safety and reporting statement on this page comes from one of these official sources, checked on 25 September 2026.

Educational information only. CreditBharosa is not a bank, lender or law-enforcement agency, and cannot investigate a case or recover money. For help with a specific incident, use the official channels above. Found an error? Tell us and we will correct it with a note.