Internet Safety: Avoid Online Scams

Internet safety means protecting your money, your personal data, and your identity from online scams and fraud. The core rules are simple and worth memorising: never share your OTP, PIN or password with anyone, don't click links from unknown senders, verify before you pay or share details, and treat any "too good to be true" offer as a scam. Fraudsters in India are clever and constantly change their tricks, but almost every scam relies on you doing one risky thing in a hurry. Slow down, apply these rules, and you'll avoid the vast majority of online fraud.

Why online safety matters more than ever

Almost everything now runs online: banking, UPI payments, job applications, shopping, government services. That convenience is also what scammers target. A single mistake, sharing an OTP, clicking a fake link, paying an advance for a "job", can cost you your savings or your identity. And unlike a physical theft, online fraud often can't be reversed once the money moves. That's why prevention is everything. You don't need to be a technical expert; you just need a few habits and a healthy suspicion of anything that pressures you to act fast.

The golden rule: OTPs and passwords are secret

This one rule prevents most banking fraud. No genuine bank, company, or government office will ever ask you for your OTP, PIN, CVV, or password, not on a call, not in an SMS, not by email. An OTP is the key to your money. If anyone asks for it "to verify", "to cancel a transaction", "to receive a refund", or "to update KYC", it is a scam, every single time. Hang up or delete the message.

Fraudsters are skilled at sounding official and creating panic ("your account will be blocked in 10 minutes"). The panic is the trick, it makes you act before you think. The answer is always the same: never share the OTP, and call your bank on the official number printed on your card if you're unsure.

Phishing: fake messages and links

Phishing is when a scammer sends a fake message pretending to be a bank, a delivery company, or a well-known brand, to trick you into clicking a link and entering your details. The link leads to a fake website that looks real but steals whatever you type.

How to spot phishing:

• Check the sender. Odd email addresses or numbers, spelling mistakes, and generic greetings ("Dear Customer") are warning signs.
• Hover before clicking. The real link may differ from the text shown. On a phone, long-press to preview the URL.
• Watch the web address. A fake site might be hdfc-secure-login.xyz instead of the real bank domain. Look carefully.
• Never enter card or login details from a link in a message. Go to the official app or type the website yourself.

Common scams in India (and how to avoid each)

The UPI "receive money" trick

This one catches many people, so it's worth its own note. To receive money on UPI, you never enter your PIN. Your PIN is only for sending money. Scammers send a "collect request" or ask you to "scan this QR to receive your refund", and if you approve it and enter your PIN, you're actually paying them. Remember: scan a QR or enter a PIN = money leaving your account. Receiving money needs nothing from you.

Fake job offers

For students and job-seekers, fake job scams are common and painful. Red flags:

• They ask you to pay a registration, training, kit, or "security deposit" fee.
• Guaranteed high salary for little work, or "work from home, earn ₹30,000, no experience".
• Offer letters with no proper company details, or a Gmail address instead of a company email.
• Pressure to pay quickly to "hold your seat".

The rule: a real employer pays you; you never pay them to get a job. Apply through trusted portals and your institute's placement cell, and verify the company exists before sharing documents.

Protect your accounts

Beyond avoiding scams, secure your accounts so a leak doesn't sink you:

• Strong, unique passwords. Mix capitals, numbers and symbols; don't reuse the same password everywhere.
• Two-step verification (2FA). Turn it on for email, banking and important apps. Even if your password leaks, the account stays protected.
• Lock your phone. A PIN, pattern or fingerprint keeps a lost phone from becoming a disaster.
• Update apps and Windows. Updates fix security holes; don't ignore them.
• Beware public Wi-Fi. Avoid banking on open Wi-Fi; use mobile data for sensitive tasks.

What to do if you're scammed

If money is lost or details are shared, act fast:

1. Call your bank immediately to block the card/account and report the transaction. Speed matters; some fraud can be reversed if reported within minutes.
2. Report on the national cybercrime helpline 1930 and the portal cybercrime.gov.in.
3. Change passwords for any affected accounts and enable 2FA.
4. Keep evidence, screenshots, messages, transaction IDs, for the complaint.

Acting within the first hour gives the best chance of recovering money.

Real-world scenario (how one call becomes a loss)

A common story: someone gets a call, "I'm from your bank; your card is blocked, share the OTP to reactivate it." It sounds urgent and official. In a panic, they read out the OTP, and within seconds money is gone, because that OTP authorised a transaction the scammer set up. Nothing about the call was real except the fear it created. The person who knows the golden rule, "banks never ask for OTP", simply hangs up and stays safe. This is why these habits matter more than any software: the weakest point in security is a person acting in a hurry, and the strongest defence is a calm "no".

Pro tips

• Treat urgency as a warning sign; scammers create panic so you act before thinking.
• When unsure, stop and verify using official numbers/apps, never numbers from a message or a web search.
• Never share OTP, PIN, CVV or passwords with anyone, for any reason.
• Teach elderly family members these rules; they're often targeted.

Common mistakes

• Sharing an OTP "to verify". No genuine caller ever needs it. This single mistake causes most fraud.
• Clicking links in messages. Go to the official app/site instead of trusting a link.
• Paying for a job. Real jobs never charge you; walk away.
• Entering a PIN to "receive" money on UPI. Receiving never needs your PIN; that's always a payment.
• Reusing one password everywhere. One leak then unlocks everything.

Key takeaways

• Never share your OTP, PIN, CVV or password, banks and companies never ask.
• Don't click links in unknown messages; go to the official app or site.
• Receiving money on UPI never needs your PIN; entering it sends money.
• Genuine jobs never charge a fee; treat "too good to be true" as fraud.
• If scammed, call your bank and report to 1930 / cybercrime.gov.in immediately.

Practice task

Look through your SMS and email from the last month and find one message that could be a scam (a "prize", "KYC update", "job offer" or a link). Identify the warning signs in it. Then check that two-step verification is turned on for your email and banking apps.

Learn safe, confident digital skills for daily life and work in the Basic Computer Course (BCC) at HCI.