How to Protect Your Net Banking Account From Phishing and Fraud

Last updated: 7 November 2026

Most net banking fraud doesn't involve a sophisticated hack of your bank's systems. It involves someone convincing you, directly, to hand over a detail that should never leave your hands. Understanding what that detail is, and what a genuine bank will never ask for, stops the overwhelming majority of these attempts before they get anywhere.

The one rule that covers most of it

A genuine bank will never call, message or email you asking for your OTP, net banking password, debit/credit card PIN, CVV, or full card number. Not to "verify your account," not to "reverse a wrongly credited amount," not to "prevent your card from being blocked." Every one of these is a scam script. If you remember nothing else from this guide, remember that one line; it closes off almost every common fraud pattern on its own.

Common scam patterns to recognise

The urgent SMS/WhatsApp link: "Your account will be blocked, click here to verify" or "KYC update pending, click to avoid suspension." The link leads to a fake site that looks like your bank's login page and captures your credentials when you type them in. Genuine KYC updates are done through your bank's app, net banking, or in person, never through a link in an unsolicited message.
The "wrong credit, please refund" call: someone calls claiming they accidentally sent you money and asks you to "verify" your account by sharing an OTP, or to install a screen-sharing app so they can "guide you" through a refund. This is designed to let them either see your screen while you're logged in, or capture an OTP that actually authorises a payment going out, not in.
The fake customer-care number: searching online for your bank's helpline and calling a number from a sponsored ad or a fake listing, rather than the number printed on your card or statement. Always get your bank's number from an official source.
The QR code or payment-request scam: being asked to scan a QR code or accept a payment request "to receive money." Scanning a QR code or approving a request on UPI always sends money out; a genuine incoming payment never requires you to scan anything or enter your PIN.

Habits that actually reduce your risk

Check the URL before logging in. Look for your bank's genuine domain, with "https" and the correct spelling, not a lookalike with extra characters or a different ending.
Set your own transaction limits inside your bank's app for daily UPI and card spending. A lower limit on an account you use for everyday spending caps your worst-case loss if something does go wrong.
Turn on SMS and email alerts for every transaction, and actually read them, rather than treating them as background noise.
Use your bank's own app for net banking rather than bookmarked links or search-engine results, which can be spoofed.
Never install a remote screen-sharing app at the request of someone who called you, regardless of what organisation they claim to represent.

If you think you've already been caught out

Block your card and freeze net banking immediately through your bank's app or official helpline, not a number from the suspicious message.
Call the National Cyber Crime Helpline, 1930, or file a report at cybercrime.gov.in. Speed matters here, since banks have a better chance of freezing a fraudulent transfer before it's withdrawn if you report within the first few hours.
Inform your bank in writing (email or the app's dispute section) as well as by phone, so there's a dated record of when you reported it.
Change every password and PIN connected to the compromised credential, even ones that weren't directly involved, as a precaution.

Common questions

Is it safe to share my IFSC code and account number with someone?

Yes. Those two details alone only let someone pay you, not take money out. See our full guide on what's actually risky to share for the difference.

Will I get my money back if I'm scammed?

It depends on how quickly you report it and the circumstances. RBI's framework on unauthorised transactions can limit your liability if you report promptly, but outcomes vary by case; reporting within hours, not days, gives you the best chance.

Are banking apps safer than net banking on a browser?

Generally yes, since an official app is harder to spoof convincingly than a browser page, and many apps add device-level checks. Either is safe as long as you access it directly rather than through a link someone sent you.

What if a message appears to come from my bank's actual number or sender ID?

Caller ID and SMS sender IDs can be spoofed, so this alone doesn't confirm authenticity. The content of the request, asking for an OTP or PIN, is the more reliable signal than who it appears to be from.

Should I be suspicious of every call from my bank?

Not every call is a scam; banks do call for legitimate reasons, such as confirming a large or unusual transaction. The distinction is what they ask for: confirming whether you made a transaction is normal, but asking you to read out an OTP, PIN or password is not, regardless of how the call started.

Try the tools

Find IFSC Code Verify IFSC Code

More guides

This guide is general information, not financial or legal advice. Limits, timings and charges are set by the Reserve Bank of India, NPCI and individual banks, and can change, so confirm current details with your bank.