Table of Contents
Net banking is how most Indians manage their money today — and it’s also one of the most targeted surfaces in Indian cybercrime. Phishing links, SIM-swap attacks, fake helpline calls, remote access scams — fraudsters have built entire playbooks around the weak points most account holders never think to close. The reassuring part: closing those weak points is entirely within your control, and takes no technical expertise. This guide gives you the settings, habits, and recognition skills to do it — bank by bank, in India-specific terms.
2 Minutes
To switch from SMS OTP to app-based OTP
6 Scams
Cover almost all net banking fraud in India
30 Minutes
Your critical window if fraud happens
Here’s the good news first: securing your net banking account doesn’t require you to become a security expert. It requires flipping a handful of switches that already exist inside your banking app — most of which you’ve probably never opened. This guide walks through every layer, from your password to your SIM card to your bank’s specific security menus, and ends with exactly what to do if something does go wrong.
Work through each section once. Most of it takes under ten minutes per bank. Then use the monitoring schedule in Section 07 to keep your defences current going forward.
01 Strengthen Your Login Security — Your First Defence Layer
The majority of net banking fraud in India begins with one of two things: a stolen password or an intercepted OTP. Both are entirely preventable. The six steps below close these entry points systematically, ranked from highest to lowest impact — start at the top.
| Security Layer | What to Do | Why It Matters |
|---|---|---|
| Strong, unique password | 12+ characters, mixed case, numbers, symbols. Never reuse a password from another app or site | Reused passwords mean a data breach anywhere becomes a breach everywhere — including your bank account |
| Two-factor authentication (2FA) | Enable OTP-based login on every account. Prefer app-based OTP (HDFC, ICICI, SBI YONO, Axis) over SMS OTP | SMS OTP is vulnerable to SIM-swap. App-based OTP is tied to your physical device and cannot be intercepted remotely |
| Never save passwords in browsers | Don’t let Chrome, Safari, or any browser save your net banking password. Use a password manager if needed | Browser-saved passwords can be extracted by malware or accessed by anyone using your device |
| Mobile app over browser login | Use your bank’s official app rather than a browser for routine transactions — apps support device binding and biometrics | Browsers are far more exposed to phishing, keyloggers, and session hijacking than dedicated banking apps |
| Avoid public Wi-Fi entirely | Never log in to net banking on cafe, airport, hotel, or shared Wi-Fi. Use mobile data instead | Public Wi-Fi allows man-in-the-middle attacks where your session can be intercepted and credentials captured |
| Log out completely after every session | Don’t just close the tab — use the bank’s official logout button to end the session on the server | An open session on a shared or unattended device gives anyone who picks it up full access to your account |
The single highest-impact change you can make today is switching from SMS OTP to app-based OTP. HDFC, ICICI iMobile, SBI YONO, and Axis Mobile all offer this. It takes under two minutes to enable and makes your account immune to SIM-swap OTP interception entirely.
Pro Tip
02 Secure Your Registered Mobile Number — The Key to Your OTPs
Your registered mobile number is the master key to your net banking account. It receives every OTP, every alert, and every account recovery code. A fraudster who gains control of your number — through a SIM swap — effectively has access to all of those. Protecting your SIM matters just as much as protecting your password, and most people have never thought about it.
| Protection Step | Protection Step How to Apply It | How to Apply It What It Prevents |
|---|---|---|
| Set a SIM PIN / SIM lock | Android: Settings → Security → SIM Card Lock. iOS: Settings → Cellular → SIM PIN. Set a 4–8 digit PIN | Prevents anyone who steals your physical SIM from using it in another device |
| Monitor for unexpected SIM deactivation | If your SIM stops receiving calls/messages without reason, call your operator immediately: Airtel 121, Jio 198, Vi 199, BSNL 1503 | Early detection of a SIM-swap attempt — every minute of delay gives the fraudster more time |
| Keep your number off public platforms | Don’t post your registered bank mobile number on social media, job portals, or classified ad sites | Reduces the chance of your number being used to initiate a SIM-swap with your operator |
| Switch to app-based OTP where available | HDFC, ICICI iMobile, SBI YONO, and Axis Mobile all offer in-app OTP generation — enable it in app settings | App-based OTP is bound to your device. A SIM swap gives a fraudster your number but not your OTP |
| Enable call/SMS forwarding restrictions | Contact your mobile operator to block call and SMS forwarding on your number unless explicitly authorised | Prevents fraudsters from silently redirecting your OTPs to another number |
How SIM-swap fraud actually works: a fraudster uses your personal details (name, Aadhaar number, address — often from data leaks) to convince your mobile operator they are you, and requests a new SIM on your number. Within hours, every OTP your bank sends goes to their device, not yours. Your first sign is typically that your phone stops receiving calls and messages — by which point they may already be inside your account. The fix is simple: enable app-based OTP and set a SIM PIN. Together, these make SIM-swap attacks completely ineffective against you.
03 Protect Your Devices — Phone and Laptop
Most net banking fraud that reaches a completed transaction does so through a compromised device. A phone with outdated software, a laptop with a keylogger, a device with remote access apps installed — any of these gives an attacker everything they need without ever touching the bank’s systems directly.
| Device Step | What to Do | Risk It Closes |
|---|---|---|
| Keep OS updated | Enable automatic updates on Android, iOS, and Windows. Check monthly that no update is pending | Unpatched OS vulnerabilities are publicly documented entry points for malware |
| Install apps from official stores only | Google Play Store or Apple App Store only. No APKs, no third-party stores, no links | Fake banking apps mimic official apps exactly and capture credentials on login |
| Delete all remote access apps | Search for AnyDesk, TeamViewer, QuickSupport, AirDroid. Uninstall every one of them | Screen-sharing apps are the primary tool used in remote access banking fraud across India |
| Enable biometric + PIN on phone | Use fingerprint or Face ID as primary unlock. Set a 6-digit PIN as backup. Auto-lock: 15–30 seconds | An unlocked phone gives anyone who picks it up immediate access to every banking app |
| Secure your home Wi-Fi | Change the default router password. Use WPA3 or WPA2 encryption. Never share your Wi-Fi password casually | An insecure home network can be used to intercept local traffic, including banking sessions |
04 Bank-Specific Security Settings — SBI, HDFC, ICICI, Axis
Every major Indian bank has security features that go far beyond the default configuration — and most users never touch these settings after opening their account. Enabling them takes under ten minutes per bank and closes some of the most commonly exploited vulnerabilities. Find your bank below and work through the list.
| Bank | Bank Critical Settings to Enable | Where to Find It |
|---|---|---|
| SBI | Enable SBI Secure OTP app (replaces SMS OTP). Activate Profile Password (separate from login password). Set High-Security Transaction Rights. Review and disable unused beneficiaries | SBI YONO app → Services → e-Services | OnlineSBI → Profile → Manage Beneficiary |
| HDFC | Enable Secure Access (image + phrase authentication). Set transaction and transfer limits explicitly. Enable email + SMS alerts for every debit. Use HDFC MobileBanking app for device-bound login | HDFC NetBanking → Security Settings | MobileBanking app → Manage → Alerts |
| ICICI | Enable OTP-based login via iMobile Pay. Activate Insta Alerts for every transaction. Enable biometric login in iMobile. Review and remove linked devices you no longer use | ICICI iMobile Pay → Services → Manage My Accounts | NetBanking → Profile → Security |
| Axis Bank | Enable NetSecure (2FA) for all net banking logins. Set daily and per-transaction limits. Enable fingerprint / Face ID in Axis Mobile app. Review beneficiary list monthly and remove inactive entries | Axis Mobile app → Settings → Security | NetBanking → My Profile → Limit Management |
| All banks | Enable transaction alerts via both SMS and email for every debit, not just large ones. Set daily transfer limits below your typical maximum usage. Remove beneficiaries added 12+ months ago and no longer used | Your bank’s app → Settings or Profile → Alerts / Limits / Manage Beneficiaries |
The beneficiary list is one of the most overlooked security surfaces in net banking. Every person or account you’ve ever added as a beneficiary remains there until you remove them. A fraudster with temporary access can add themselves as a beneficiary and initiate transfers later — even after you’ve regained control. Review your beneficiary list monthly and remove anyone you haven’t used in six months. It takes under two minutes.
Pro Tip
05 Protect Your Transactions — Alerts, Limits, and Safe Habits
Your login credentials and OTP protect access to your account. The settings in this section protect what happens inside your account once you’re logged in — limiting the damage even if something does go wrong somewhere else
| Setting / Habit | How to Apply It | Why It Matters |
|---|---|---|
| Transaction alerts for every debit | Enable SMS and email alerts for every transaction — not just transactions above a threshold | You find out within seconds if something unauthorised occurs. Days-later discovery makes recovery far harder |
| Set daily transfer limits below your maximum | Your bank app lets you set per-day and per-transaction caps. Keep them below your realistic daily maximum | Even if a fraudster gets in, they cannot move large amounts in a single session |
| Prefer bank apps over browsers | Use your bank’s official mobile app for routine transactions rather than a browser | Apps are device-bound, support biometrics, and are harder to phish than browser sessions |
| Use UPI with device binding | UPI is bound to your device and SIM by default. Do not register UPI on shared or work devices | A device-bound UPI account cannot be used from another phone, even with your credentials |
| Never save card details on websites | Prefer tokenisation (RBI-mandated) over raw card saving. Avoid saving on small or unfamiliar merchant sites | Tokenised cards expose a secure token, not your real card number, in a merchant data breach |
06 The Six Most Common Net Banking Scams in India — Recognised Instantly
Banks never ask for your OTP, PIN, CVV, or password. If anyone does — regardless of who they claim to be, regardless of what details they already know about you — it is a scam. The table below covers every major pattern currently active in India.
| Scam Type | How It Reaches You | The Give-Away Sign |
|---|---|---|
| Fake KYC update SMS / WhatsApp | A message claiming your account will be blocked unless you complete KYC immediately via a link | RBI and banks never send KYC update requests via WhatsApp. KYC is done through your bank’s app only |
| Fake bank helpline numbers | You search for your bank’s helpline on Google — a paid ad or fake listing shows a fraudster’s number | Find helpline numbers only from your banking app or the back of your card — never from a search engine |
| Phishing emails mimicking SBI/HDFC/ICICI/Axis | An email with your bank’s logo asks you to verify your account or log in via an attached link | Banks never ask you to log in via an email link. The sender’s domain won’t match your bank’s official domain |
| Remote access scams (AnyDesk / QuickSupport) | A caller claiming to be customer care asks you to install a screen-sharing app for ‘remote assistance’ | No bank ever asks you to install a screen-sharing app. Hang up immediately |
| Fake UPI collect requests | A payment request arrives in your UPI app framed as a ‘refund’ or ‘verification’ you’re asked to approve | Receiving money via UPI requires zero action from you. Approving a collect request sends money out |
| Fraudulent refund calls | A caller claims to process a refund and needs your OTP or card details to ‘credit’ the amount | Real refunds are automatic. No refund process ever asks for your OTP, CVV, or account credentials |
Fraudsters who call claiming to be from your bank often already know your name, partial account number, or last transaction. This information comes from data leaks and does not make them legitimate. The rule is absolute: no bank representative ever needs your OTP or password over a phone call. Knowing this one rule, without exception, makes you immune to every scam in this table.
07 Monitor Your Account Like a Hawk — What to Check and When
Consistent monitoring is how fraud is caught early — before a small test transaction becomes a large loss. The table below gives you a complete monitoring schedule. Follow it, and you’ll catch almost anything unusual within days, not months.
| # | Monitoring Task | How Often | What to Look For |
|---|---|---|---|
| 1 | Check mini statement / transaction history | Weekly | Any debit you don’t recognise, however small. Small test transactions precede larger fraud |
| 2 | Review saved beneficiaries | Monthly | Remove anyone you haven’t transferred to in the last 6 months. An unknown beneficiary is a red flag |
| 3 | Download full bank statement | Monthly | Compare against your own spending records. Flag any discrepancy immediately |
| 4 | Check login history / active sessions | Monthly | Most bank apps show recent login dates and device names. An unknown device means a compromised password |
| 5 | Review linked devices in banking app | Quarterly | Remove devices you no longer use. Each linked device is a potential access point |
| 6 | Verify email/SMS alert settings | Quarterly | Confirm all alerts are still active. Banks occasionally reset notification settings after app updates |
| 7 | Update net banking password | Every 6 months | Change your password even if nothing suspicious occurred. Proactive rotation limits damage from an undetected breach |
Set recurring calendar reminders for the monthly and quarterly checks right now — before you close this guide. The weekly mini-statement check is the single most effective monitoring habit. Most fraud involves a small test transaction first. Catching it early stops everything that follows.
Pro Tip
08 What to Do If You Suspect Fraud — Act Within 30 Minutes
Time is the single most critical factor in net banking fraud recovery. Every minute of delay reduces the amount you can recover and increases the damage done. Follow these six steps in order, as quickly as you possibly can.
Step 1
From a secure device on your home Wi-Fi. Do this before anything else — it locks the fraudster out if they have your credentials but haven’t yet changed the password themselves.
Step 2
Cards → Block Card. This takes under 30 seconds and stops all card-based transactions instantly.
Step 3
Call your bank’s 24-hour fraud helpline and ask them to place a hold on your account while the investigation is open. This prevents transfers even if the fraudster still has your old credentials.
Step 4
SBI 1800-111-109, HDFC 1800-202-6161, ICICI 1800-200-3344, Axis 1800-419-5959. Report the fraud, dispute unauthorised transactions, and request a chargeback. Under RBI’s Zero Liability Policy, prompt reporting gives you the strongest chance of a full refund.
Step 5
This creates a legal record and is required for formal fraud recovery through the banking dispute mechanism.
Step 6
Email your branch with the incident details and request it be logged. A written record at branch level strengthens your dispute if it escalates to the RBI Ombudsman.
Save your bank’s fraud helpline in your phone contacts right now — in a stressful moment, searching for the number costs precious minutes. SBI: 1800-111-109 | HDFC: 1800-202-6161 | ICICI: 1800-200-3344 | Axis: 1800-419-5959 | Cybercrime: 1930
Pro Tip
Quick Reference: Key Portals and Helplines
| Item | Where to Go |
|---|---|
| Cybercrime Helpline | 1930 — national helpline, 24×7 |
| Report net banking fraud | cybercrime.gov.in — National Cyber Crime Reporting Portal |
| SBI fraud helpline | 1800-111-109 (toll-free) or SBI YONO app |
| HDFC fraud helpline | 1800-202-6161 or HDFC MobileBanking app |
| ICICI fraud helpline | 1800-200-3344 or ICICI iMobile Pay app |
| Axis Bank fraud helpline | 1800-419-5959 or Axis Mobile app |
| RBI Ombudsman (unresolved disputes) | cms.rbi.org.in — RBI Complaint Management System |
| Block SIM / report SIM swap — Airtel | Call 121 or visit airtel.in |
| Block SIM / report SIM swap — Jio | Call 198 or visit jio.com |
| Block SIM / report SIM swap — Vi | Call 199 or visit myvi.in |
| Set SIM PIN — Android | Settings → Security → SIM Card Lock → Lock SIM Card |
| Set SIM PIN — iOS | Settings → Cellular → SIM PIN → Enable |
| SBI Secure OTP app | Download from Google Play Store or Apple App Store — search ‘SBI Anywhere’ |
| SEBI RIA (fee-only financial adviser) | sebi.gov.in under Intermediaries → Registered Investment Advisers |
Securing your net banking is not a one-time setup — it’s a layered, continuous habit, and each layer closes a specific attack vector that fraudsters actively exploit. A strong, unique password plus app-based OTP is your first and most important defence. SIM lock plus app-based OTP neutralises SIM-swap attacks completely. Bank-specific security settings — most Indian users have never opened these menus. Transaction alerts for every debit mean you find out within seconds, not days. The six scam types in this guide are each recognisable the moment they start, if you know the pattern. And monthly monitoring of your mini statement, beneficiaries, linked devices, and login history catches almost everything else. Above all: banks never ask for your OTP, PIN, CVV, or password. If anyone asks — regardless of who they claim to be — the answer is always the same: hang up.
