Table of Contents
Your smartphone holds your UPI apps, net banking login, every SMS OTP, and your email. If a fraudster gets into your phone, they don’t need to break into your bank — everything they need is already there. UPI-related fraud in India more than doubled between 2022 and 2024, and the majority of cases involved compromised phones, not broken banks. This guide gives you nine rules — one per security layer — and a five-minute monthly checklist that closes almost every door a fraudster could walk through.
2x
UPI fraud growth in India between 2022 and 2024
9 Rules
One per security layer — from lock screen to phishing
5 Minutes
Monthly checklist that covers every layer
Think about what lives on your smartphone right now: your UPI apps, your net banking login, your credit card details saved on shopping platforms, every SMS OTP that arrives, your email. The phone is not just a communication device any more — it is the master key to your entire financial life.
Most people protect their phone with a lock screen and call it done. That’s a start, but it’s one layer out of nine. Fraudsters don’t always steal your phone — they plant fake apps, exploit unpatched software, intercept your OTPs via malicious apps with SMS access, or simply talk you into handing over access via screen-sharing. This guide closes all nine doors, in plain language, with specific settings for Indian Android and iOS users.
01 Rule 1 — Lock Down Your Device: Your First Line of Defence
A strong lock screen is the simplest and highest-impact security step on this list. An unlocked phone found by a stranger, or accessed by a thief, is an open door to every financial app, every saved password, and every OTP that arrives by SMS. This one setting prevents all of that.
- Use a 6-digit PIN or alphanumeric password — patterns leave smudge traces on the screen and are easier to guess than you’d expect
- Enable fingerprint or Face ID for quick, secure access without sacrificing protection
- Set auto-lock to 15–30 seconds — the shortest duration your daily use allows comfortably
- Use a separate app lock for your banking and UPI apps as a second barrier inside the phone
Most banking apps in India — HDFC, ICICI, SBI YONO, Axis, PhonePe, GPay — have their own PIN or biometric lock setting inside the app, separate from the phone lock screen. Enable both. If your phone lock is bypassed, the app lock is the last barrier between a fraudster and your account.
Pro Tip
02 Rule 2 — Keep Your OS and Financial Apps Updated
Every few weeks, Android and iOS release security patches that fix known vulnerabilities. Fraudsters and malware authors actively target devices running older software, because the entry points are publicly documented and the exploits are already built. An unpatched phone is a phone with known, available doors that haven’t been locked yet.
- Enable automatic OS updates on Android (Settings → Software Update) and iOS (Settings → General → Software Update)
- Enable automatic updates for all banking, UPI, trading, and wallet apps in the Play Store or App Store
- Remove apps you no longer use — outdated, inactive apps can be exploited even if you never open them
An app you last updated six months ago may have known, exploitable security gaps that the developer has already fixed — for users who updated. This applies equally to WhatsApp, browsers, and file-manager apps, not just banking apps. Any app with internet access or SMS permission is a potential entry point if left unpatched.
03 Rule 3 — Install Apps Only From Official Stores. No Exceptions.
Fake apps that mimic PhonePe, GPay, BHIM, SBI YONO, HDFC MobileBanking, and major trading platforms are distributed via WhatsApp links, SMS messages, and third-party websites. They look identical to the real apps. The moment you log in, your credentials, card details, and SMS access are captured and sent to the fraudster — silently, instantly.
- Download every app — without exception — from the Google Play Store or Apple App Store only
- Before installing, verify the developer name matches the institution, check review count and recency, and confirm the last update date
- Never install an APK file, a modded app, or anything from a third-party website or app store
- If your bank or UPI app sends you a link to ‘install the latest version’, ignore the link and update via the official store instead
When in doubt about any app, search the institution’s official website for the download link, then follow that link to the Play Store or App Store. Don’t search directly in the store — fraudulent apps with near-identical names and icons appear in search results and aren’t always caught before someone installs them.
Pro Tip
04 Rule 4 — Never Use Public Wi-Fi for Any Financial Transaction
On an open Wi-Fi network — at a café, airport, hotel lobby, or shopping mall — anyone on the same network can potentially intercept the data your phone sends and receives. This includes login sessions, authentication tokens, and in some configurations, OTPs. The attack doesn’t require expensive equipment or specialist skills.
- Use mobile data or your home Wi-Fi for all UPI, banking, trading, and card transactions
- If mobile data is genuinely unavailable, connect through a reputable VPN before opening any financial app
- Disable auto-connect to open networks: Settings → Wi-Fi → turn off ‘Connect to open networks’ or ‘Auto-connect’
- Log out of financial apps after use rather than leaving sessions open indefinitely
Hotel and airport ‘secured’ Wi-Fi with a password is not materially safer than open Wi-Fi for financial transactions — the password is shared with hundreds of users. The risk of interception is different in degree, not in kind. Mobile data is the correct choice for any financial activity away from home.
05 Rule 5 — Audit Your App Permissions, Especially SMS Access
Many apps request access to SMS, contacts, microphone, camera, and storage that they have no legitimate reason to need. SMS permission is the most dangerous: an app with SMS access can silently read every OTP that arrives on your phone and send it to a remote server without any visible sign on your screen. You’d never know it was happening.
- Android: Settings → Apps → Permission Manager → SMS — review every app listed and revoke access from any that shouldn’t have it
- iOS: Settings → Privacy — review each permission category and revoke unnecessary access
- Revoke microphone and camera access from any app you didn’t deliberately grant it to
- If an app suddenly requests a new permission it never asked for before, treat it as a red flag and investigate before granting
Do a permissions audit once a month, not once a year. New apps request permissions at install, and existing apps can request additional permissions with updates. A shopping or utility app you installed six months ago may have silently requested SMS access in an update you approved without reviewing. One monthly check catches this.
Pro Tip
06 Rule 6 — Enable Your Phone’s Built-In Security Tools
Every modern Android and iOS device ships with security tools that actively protect against the most common mobile threats. Most users never turn them on or check that they’re running. These tools are free, built-in, require no technical knowledge to use, and catch a significant proportion of malware before it can cause damage.
- Google Play Protect (Android): scans every installed app daily for malware. Play Store → Profile icon → Play Protect → confirm it is active and run a manual scan now
- Safe Browsing in Chrome: blocks known phishing websites before they load. Chrome → Settings → Privacy and Security → Safe Browsing → set to Enhanced
- Find My Device (Android) / Find My iPhone (iOS): enables remote lock, location, and wipe. Sign in at android.com/find or icloud.com/find and confirm your device appears
- Spam protection for calls: both Android and iOS have built-in call screening — enable it to filter fraudulent calls before they reach you
Verify remote wipe is working before you ever need it. Sign in to android.com/find or icloud.com/find from your laptop right now. If your device appears, remote wipe is available. If it doesn’t appear, fix that setting today — not after your phone is lost or stolen.
07 Rule 7 — Never Root or Jailbreak Your Device
Rooting an Android device or jailbreaking an iPhone removes the security architecture the manufacturer and OS developer built in. A rooted device can run software with full system access — including malware that reads OTPs, captures screens, exfiltrates data from banking apps, and operates invisibly in the background, with no visible trace.
- Most Indian banking apps detect rooted devices and refuse to run — HDFC, ICICI, SBI, Axis, PhonePe all do this by design
- If you bought a second-hand phone, confirm it has not been rooted before using it for any financial app
- Android: install a root checker app from the Play Store to verify. iOS: a jailbroken device typically has an app called Cydia installed
A rooted phone that appears to function normally can still be silently compromised. Root access allows malware to hide from Play Protect, disable security apps, and operate in ways that leave no visible trace. If you have ever rooted a device, consider doing a full factory reset before using it for any financial transactions
08 Rule 8 — Enable Cloud Backup and Remote Wipe Before You Need Them
Remote wipe lets you erase all data from a lost or stolen phone in under two minutes, from any other device. Cloud backup means you restore everything — apps, contacts, settings — on a replacement device without losing your data. Both need to be set up before an incident, not scrambled for after one.
- Android: Settings → Google → Backup — enable backup to Google Drive and confirm Find My Device is active
- iOS: Settings → [your name] → iCloud → iCloud Backup — enable and run a manual backup now to confirm it works
- Verify backup is current — a backup from three months ago doesn’t protect data added since then
- After setting up, test the remote lock function — not the wipe, just the lock — from another device to confirm it responds
If your phone is lost and you’re unsure whether it was stolen or misplaced, use remote lock first. This prevents anyone else from accessing it while you look for it, without erasing your data. Wipe only when you’re certain the device is not coming back.
Pro Tip
09 Rule 9 — Stay Alert for Phishing on SMS, WhatsApp, and Fake Calls
Most mobile financial fraud in India doesn’t arrive via email. It arrives via SMS, WhatsApp, and phone calls. The messages look official. The callers sound professional. They know your name, sometimes your partial account details. And the goal is always the same: get your OTP, your PIN, your card details, or access to your screen.
- Never click links about KYC updates, refunds, reward claims, account suspension, or overdue bills sent via SMS or WhatsApp
- Never share your OTP, UPI PIN, CVV, or net banking password with any caller, regardless of who they claim to be
- Never install AnyDesk, TeamViewer, QuickSupport, or any ‘support app’ at a caller’s request — no legitimate bank or government department asks for this
- Always find bank helpline numbers from your official banking app or the back of your card — never from a Google search or a message you received
The most dangerous moment is when something feels urgent and someone is telling you to act immediately. That urgency is manufactured. Real banks and real government departments give you time to verify. If a call or message is pushing you to act in the next few minutes, that pressure itself is the fraud. Hang up. Verify independently through an official channel.
10 Your Five-Minute Monthly Phone Security Checklist
Run through this table once a month. It takes under five minutes and covers every security layer in this guide. Set a recurring reminder on the first of each month before you close this guide — that single habit is what separates a secure phone from a vulnerable one
| Security Check | Security Check Where to Do It | How Often |
|---|---|---|
| Lock screen PIN or biometric active | Settings → Security → Screen Lock | Once, then verify monthly |
| Auto-lock set to 15–30 seconds | Settings → Display → Screen Timeout | Once, check quarterly |
| OS update pending? | Settings → About Phone → Software Update (Android) | General → Software Update (iOS) | Monthly |
| All financial apps updated? | Play Store or App Store → Manage Apps → Updates | Weekly |
| Google Play Protect active? | Play Store → Profile → Play Protect → Scan | Monthly |
| Any app with SMS permission that shouldn’t have it? | Settings → Apps → Permission Manager → SMS (Android) | Monthly |
| Remote wipe enabled? | ||
| Remote wipe enabled? | android.com/find or icloud.com/find — sign in and confirm device is visible | Quarterly |
| Screen-sharing apps installed? | Search phone for AnyDesk, TeamViewer, QuickSupport — uninstall if found | Monthly |
11 What to Do If Your Phone Is Compromised — The First 30 Minutes
Speed is the most important factor in limiting damage when your phone is compromised. Follow these six steps in strict sequence, as quickly as possible — ideally within 30 minutes of discovering the problem.
Step 1
From another device: Android → android.com/find. iPhone → icloud.com/find. If the phone is stolen or being actively misused, wipe it immediately. If you’re unsure, lock first.
Step 2
Ask them to temporarily block your UPI access, debit and credit cards, and net banking login. This prevents any transactions even if OTPs are currently being intercepted on the compromised device.
Step 3
On your home Wi-Fi, change net banking passwords, your registered email, and all trading or wallet platforms. Change your UPI PIN from your bank’s official app. Do this before opening any financial app on the compromised phone.
Step 4
If your SIM has stopped receiving calls and messages, call your mobile operator immediately. Airtel: 121 | Jio: 198 | Vi: 199 | BSNL: 1503. Report a possible SIM swap and request any new SIM issued on your number be blocked.
Step 5
This creates the legal record required for any formal fraud recovery process through your bank or card issuer. 1930 is the national cybercrime helpline, available 24×7.
Step 6
Check the last 30 days of transactions across every linked account. Raise a chargeback or dispute for every unauthorised charge, however small — small test charges often precede larger fraud.
Save your bank’s 24-hour fraud helpline and 1930 in your phone contacts right now. Also bookmark android.com/find or icloud.com/find on your laptop today, so you can reach remote wipe without searching for it in a stressful moment. SBI: 1800-111-109 | HDFC: 1800-202-6161 | ICICI: 1800-200-3344 | Axis: 1800-419-5959
Pro Tip
Quick Reference: Key Portals and Helplines
| Item | Where to Go |
|---|---|
| Cybercrime Helpline (call) | 1930 — national helpline, 24×7 |
| Report mobile fraud online | cybercrime.gov.in — National Cyber Crime Reporting Portal |
| Google Play Protect (Android) | Play Store → Profile → Play Protect → Scan |
| Find My Device (Android) | android.com/find — remote lock, locate, or wipe |
| Find My iPhone (iOS) | icloud.com/find — remote lock, locate, or wipe |
| Android OS update | Settings → About Phone → Software Update |
| Apple iOS update | Settings → General → Software Update |
| Block UPI / cards instantly | Bank’s mobile app → Cards or UPI → Block, or call the 24-hour fraud helpline |
| Report a fraudulent Android app | play.google.com → app listing → Flag as inappropriate |
| Check app SMS permissions | Settings → Apps → Permission Manager → SMS (Android) |
There is no single step that protects your phone — what works is layering. Lock screen and auto-lock: your first barrier if the phone is lost. OS and app updates: close known vulnerabilities before they’re exploited. Official stores only: eliminate fake app fraud entirely. No public Wi-Fi: remove the interception risk. Permissions audit: stop spyware reading your OTPs silently. Built-in security tools enabled: Play Protect, Safe Browsing, Find My Device. No rooting or jailbreaking: preserve the security architecture the manufacturer built in. Remote wipe enabled: protect your data even after the phone leaves your hands. Phishing awareness: recognise the attack before you click, install, or share anything. Run the five-minute monthly checklist in this guide. That single habit closes almost every door a fraudster could walk through.
