Table of Contents
Every major Indian bank has world-class fraud detection. Every UPI transaction is monitored. RBI has built layer after layer of security around your money. Screen-sharing fraud bypasses all of it — because it never touches the bank’s systems. It goes straight to you. This guide gives you everything you need to recognise this scam instantly, protect yourself completely, and act within 30 minutes if you’ve already been targeted.
1 Rule
No legitimate institution ever needs your screen
4 Patterns
Cover almost all screen-sharing fraud in India
₹50,000+
Typical loss in a single session, some lose everything
Victims typically lose ₹5,000 to ₹50,000 in a single session. Some lose their entire bank balance. And unlike most fraud, victims often don’t realise what happened until the next day — because the entire session felt like a legitimate support call. This guide breaks down exactly how each pattern works, what scammers can actually see and do, and the seven steps that stop the damage cold if you’ve already been targeted.
01 The Golden Rule — Read This Before Anything Else
If you remember nothing else from this guide, remember this: no legitimate institution in India — not a bank, not RBI, not a UPI company, not a delivery partner, not any government department — ever asks you to install a screen-sharing app. Not once. Not for any reason.
This is not a guideline or a best practice. It is an absolute. There is no legitimate use case for a bank or government body to access your screen remotely. The entire premise — ‘we need to see your screen to help you’ — is the fraud itself. The moment anyone asks for this, the call is over.
You don’t need to be rude. You don’t need to explain yourself. You hang up, and then you verify with your bank using the number on the back of your card or in your banking app.
Save your bank’s official fraud helpline in your phone contacts right now. If you receive a suspicious call claiming to be from your bank, hang up and call that saved number back. A real bank representative will never be offended that you verified. A scammer will pressure you not to — that pressure itself is the tell.
Pro Tip
02 How This Scam Starts — Every Pretext Fraudsters Use
Screen-sharing fraud always begins with a believable pretext. Fraudsters choose scenarios that create urgency, invoke authority, or offer something you want — a refund, a job, a resolved delivery issue. The pretext is designed to make the request for screen sharing seem reasonable. None of it is.
| Who They Pretend to Be | Trigger Line They Use | What They Actually Want |
|---|---|---|
| Fake bank customer care | “Your account has been flagged for suspicious activity — we need to verify it remotely.” | Your OTP, UPI PIN, and net banking login visible on screen |
| Fake RBI / KYC agent | “Your KYC is expiring. Your account will be blocked tonight unless you complete verification now.” | Aadhaar / PAN details, banking credentials, SMS OTPs |
| Fake UPI support (GPay / PhonePe) | “Your UPI ID is showing an error. Share your screen so we can fix it from our end.” | UPI PIN entry, linked bank account details |
| Fake delivery partner | “Address update nahi ho raha app mein — ek minute screen share kar do.” | OTP pop-ups, SMS inbox, any financial app open on screen |
| Fake job / loan agent | “Document verification ke liye screen share karna padega — it’s our standard process.” | Banking app activity, SMS inbox, identity documents |
| Fake Amazon / Flipkart refund agent | “Hamne galti se extra amount bhej diya — refund process ke liye screen share karo.” | UPI app navigation, PIN entry, transaction approval |
Fraudsters often know your name, your bank’s name, sometimes your partial account number or your last transaction. This information comes from data leaks, social media, and previous scam attempts. Knowing these details does not make a caller legitimate. It makes them more dangerous, because it creates false credibility. Verify independently regardless — knowing something about you proves nothing about who they are.
03 What Scammers Can See and Do Once You Share Your Screen
This is the part most people underestimate. Sharing your screen is not giving someone a limited view of one thing. It is giving them a live feed of your entire phone, updated in real time. Everything that appears on your screen — for as long as the session runs — is visible to them. Here is exactly what they can access and how they use each piece:
| What They Can See | How They Use It Against You |
|---|---|
| OTP pop-ups and SMS inbox | Read every OTP the moment it arrives. Authorise transactions before you even notice the message |
| UPI PIN entry screen | Watch you type your PIN. Use it immediately to approve a collect request or initiate a transfer |
| Net banking login | Capture your username and password as you type. Reset your account from another device while you sleep |
| Banking app screens | See your full account balance, linked accounts, and transaction history. Plan the maximum they can extract |
| Aadhaar / PAN images | Use for identity theft, SIM-swap requests with your mobile operator, or fraudulent loan applications in your name |
| Email and social media | Reset banking passwords via email. Access saved card details on shopping platforms |
| Session recording | Many remote access apps record the entire session. Credentials captured once can be used repeatedly, long after the call ends |
The fraudster does not need direct control of your phone to steal from you. They watch your screen and tell you what to tap: ‘Open your UPI app now.’ ‘Yes, tap confirm.’ ‘Don’t worry, this is just a verification step.’ By the time the session ends, you have approved a payment, they have your PIN, and your account is drained — all while believing you were being helped.
04 Four Active Fraud Patterns Targeting Indian Users Right Now
These four patterns account for the overwhelming majority of screen-sharing fraud reported in India. The specific scripts vary slightly, but the structure is always the same: create urgency, establish fake authority, request screen sharing, watch and extract.
| Pattern | How It Plays Out | How It Plays Out The Moment to Recognise It |
|---|---|---|
| A. KYC Expiry | You receive an SMS or WhatsApp about expiring KYC. A caller follows up sounding official, asks you to install AnyDesk, then guides you to open your UPI app and watches everything | No bank or RBI sends KYC requests via WhatsApp. Any caller who follows up a KYC message and asks for screen sharing is a fraudster |
| B. Refund Scam | ‘We sent extra money by mistake and need to recover it.’ They ask you to open your UPI app and share your screen to ‘process the refund’ — then watch you enter your PIN and immediately send a collect request | Real refunds are automatic. No refund process ever requires screen sharing or you entering your UPI PIN |
| C. Delivery Update | A fake delivery partner calls about a package that can’t be delivered. They ask for a quick screen share to ‘update the address in their system’, then watch your SMS inbox for OTPs | Real delivery companies update addresses through their own app. They never need access to your screen |
| D. Job / Loan Verification | A fake HR executive or loan agent asks for screen sharing to ‘verify documents’ as part of onboarding. They capture your banking app activity and SMS inbox during the ‘verification’ | Legitimate employers and lenders verify documents through official portals or in person. Screen sharing is never part of any genuine process |
The common thread across every pattern is urgency. KYC expiring tonight. Refund processing now. Delivery failing today. Job verification due this afternoon. That urgency is manufactured — it is designed to stop you thinking clearly and checking independently. The moment you feel pressured to act immediately, slow down. That pressure is the fraud telling you it is working.
05 How to Protect Yourself — Six Steps to Take Today
The most effective protection against screen-sharing fraud is removing the tools before a fraudster can convince you to use them. The following steps take under 10 minutes in total and close every door this scam depends on.
| Protection Step | How to Apply It | What It Prevents |
|---|---|---|
| Delete all remote access apps | Search your phone for AnyDesk, TeamViewer, QuickSupport, AirDroid. Uninstall every one | Removes the tool before a scammer can convince you to use it |
| Disable install from unknown sources | Android: Settings → Security → Install Unknown Apps → turn off for all apps | Stops scammer-sent APKs from installing even if you tap the link |
| Enable app-level lock on banking apps | Each banking / UPI app has its own PIN or biometric setting — enable it in every app you use | Second barrier even if your phone screen is being shared or the phone is unlocked |
| Turn off lock-screen notification previews | Settings → Notifications → On Lock Screen → Hide Sensitive Notifications | OTPs don’t appear on screen while it is being remotely watched |
| Enable 2FA on email linked to bank accounts | Gmail / Outlook → Security → Two-Step Verification → enable for your account | Prevents password reset attacks launched via your email account |
| Block unknown callers | Phone app → Settings → Block Numbers / Spam Protection — enable where available | Reduces the volume of fraudulent calls reaching you in the first place |
Do a monthly check — search your phone for AnyDesk, TeamViewer, QuickSupport, AirDroid, and any app with ‘remote’ or ‘support’ in its name. If you find any that you didn’t deliberately install for professional use, uninstall them immediately. This single habit takes under 60 seconds and eliminates the primary tool fraudsters depend on.
Pro Tip
06 The 10-Second Safety Checklist for Any Suspicious Call
Use this table the moment a call or message feels unusual. You don’t need to analyse the situation in detail. If what they’re saying matches anything in the left column, the response in the right column is always correct — without exception, without further discussion.
| If They Say or Ask This | Your Response — Always |
|---|---|
| Unknown caller asking you to install AnyDesk, TeamViewer, or QuickSupport | Scam. Hang up immediately. Do not install anything. |
| “Share your screen to verify your UPI / bank account.” | Scam. No legitimate institution in India ever requires this. |
| “Approve this collect request to verify your account.” | Scam. Approving a collect request sends money out of your account. |
| “Enter your UPI PIN on screen so we can confirm it.” | Scam. Your PIN is never required for verification by anyone. |
| “Your KYC is expiring — screen share so we can complete it.” | Scam. KYC is completed through your bank’s official app only. |
| “We need remote access to fix a problem with your banking app.” | Scam. Banks fix app issues through updates, not remote access. |
| “Install this support app and share the 9-digit code with me.” | Scam. That 9-digit code is the remote access key to your entire device. |
| They already know your name, partial account number, or last transaction | Still a scam. This data comes from leaks. Knowing it proves nothing about who they are. |
‘They already know your name, partial account number, or last transaction.’ This is the most common reason people don’t hang up. They assume that because the caller knows something, they must be legitimate. This is wrong — and it is exactly the assumption fraudsters are exploiting. That information comes from data leaks. Having it proves nothing. Hang up regardless.
One line deserves particular attention:
07 What to Do If You Already Shared Your Screen — The First 30 Minutes
If you’ve already shared your screen with someone, act immediately. Do not wait to see if anything happens — the damage may already be underway, silently, in the background. Every minute of delay increases both the amount lost and the difficulty of recovery. Follow these seven steps in strict sequence.
Step 1
Cut internet access immediately — this is Step 1, not Step 3
Turn off mobile data and Wi-Fi right now. This ends the remote session dead — the fraudster loses visibility of your screen and cannot see any further OTPs or app activity. Do this before anything else.
Step 2
Remove AnyDesk, TeamViewer, QuickSupport, AirDroid, or whatever was installed — before you reconnect. Reconnecting with the app still installed can resume the session.
Step 3
Change your UPI PIN, net banking password, and email password on your home Wi-Fi. Do this before opening any financial app on the phone that was shared.
Step 4
Report the incident, ask them to flag your account for unusual activity, and temporarily block your debit and credit cards and UPI access. SBI: 1800-111-109 | HDFC: 1800-202-6161 | ICICI: 1800-200-3344 | Axis: 1800-419-5959
Step 5
Check your bank statements, UPI history, and email inbox for any unauthorised activity during the screen-share period. Raise a chargeback dispute for every unauthorised charge, including small test amounts.
Step 6
This creates the legal record required for formal fraud recovery. If your Aadhaar or PAN were visible on screen, also report at uidai.gov.in to flag potential identity misuse.
Step 7
If your SIM stops working unexpectedly in the hours or days after the incident, call your operator immediately. Airtel: 121 | Jio: 198 | Vi: 199 | BSNL: 1503
cut internet access before anything else. This ends the remote session immediately and prevents the fraudster from seeing any further OTPs or app activity while you work through the remaining steps. Save 1930 and your bank’s fraud helpline in your contacts right now, so you’re not searching in a stressful moment.
The single most important action is Step 1:
08 Final Word — The Door Is Yours to Close
Screen-sharing fraud is among the most effective financial scams operating in India today precisely because it requires no technical skill to execute and no technical failure to succeed. It only requires one thing: that you install an app and share your screen.
Every protection in this guide addresses that single moment. Delete the apps before a call comes. Recognise the pretext when the call arrives. Know that urgency is the weapon. Understand that no legitimate institution ever needs this access.
You don’t need to be suspicious of everyone. You need to know one rule clearly enough that it is automatic: screen sharing for banking, UPI, KYC, refunds, or any financial purpose is always fraud. Always.
Share this guide with your parents, your household, and anyone who uses UPI or online banking. Senior citizens are disproportionately targeted by this scam because the authority figures used — bank officials, RBI agents, police — are ones they are conditioned to trust and not question. A single conversation about this scam can protect their entire savings.
Pro Tip
Quick Reference: Key Portals and Helplines
| Item | Where to Go |
|---|---|
| Cybercrime Helpline (call) | 1930 — national helpline, 24×7 |
| Report screen-sharing fraud online | cybercrime.gov.in — National Cyber Crime Reporting Portal |
| SBI fraud helpline | 1800-111-109 (toll-free, 24×7) |
| HDFC fraud helpline | 1800-202-6161 |
| ICICI fraud helpline | 1800-200-3344 |
| Axis Bank fraud helpline | 1800-419-5959 |
| Report Aadhaar misuse | uidai.gov.in or call 1947 (UIDAI helpline) |
| Report SIM swap — Airtel / Jio / Vi / BSNL | Airtel: 121 | Jio: 198 | Vi: 199 | BSNL: 1503 |
| Disable unknown sources — Android | Settings → Security → Install Unknown Apps → disable for all |
| Check / remove AnyDesk | Play Store → search AnyDesk → if installed, uninstall immediately |
| RBI Ombudsman (unresolved fraud) | cms.rbi.org.in — for disputes not resolved by your bank |
Screen-sharing fraud works because it bypasses every layer of bank security by getting you to hand over access voluntarily. The technology is not the weakness — the deception is. No legitimate institution in India — not a bank, not RBI, not a UPI company, not a delivery partner, not any government department — ever asks for screen sharing. Not once. Not for any reason. The four fraud patterns in this guide cover almost all screen-sharing crime in India: KYC expiry, refund scam, delivery update, job or loan verification. Know them and you recognise the script the moment it starts. If you’ve already shared your screen: cut internet immediately, uninstall the app, change all PINs and passwords, call your bank, and file on cybercrime.gov.in — all within 30 minutes. And delete all remote access apps from your phone today. The best protection against this scam is not having the tool installed in the first place. If a call feels urgent and they want access to your screen — that urgency is the fraud.
