Common Online Scams in India and How to Spot Them -

Quick answer: The most common online scams in India right now are fake “digital arrest” video calls, investment tips in WhatsApp and Telegram groups, fake KYC and bank alerts, fake customer care numbers, “scan to receive money” UPI tricks and malicious APK apps. Nearly all of them rely on two things: making you panic or get greedy, and getting you to approve a payment, install an app or share a code. Slow down, verify through an official number, and never enter your UPI PIN to receive money.

Scammers change their scripts often, but the patterns repeat. If you learn to recognise the pattern, you won’t need to know every new variation.

Below are the scams Indian authorities have warned about most, how each one works in plain terms, and the single habit that stops it. This guide is current as of October 2026.

1. “Digital arrest” calls from fake police, CBI or customs

You get a call, often followed by a video call, from someone in uniform who says you or a relative are linked to a crime. They tell you you’re under “digital arrest”, that you must stay on camera and tell no one, and that you must transfer money for “verification”, “fund regularisation” or bail.

The truth: there’s no such thing as a digital arrest. The Indian Cyber Crime Coordination Centre (I4C) has said plainly that “CBI/Police/Custom/ED/Judges DO NOT arrest you on video call,” as reported by Deccan Herald and The Tribune.

What to do: hang up. Tell a family member. Report the number on Sanchar Saathi’s Chakshu and, if you’ve paid anything, call 1930.

2. WhatsApp and Telegram “investment” groups

You’re added to a group full of people praising an “expert” who shares stock tips. Eventually you’re sent a link to a trading app that isn’t on the Play Store or App Store. The app shows big profits, so you invest more. When you try to withdraw, you’re asked to pay “tax” or a “verification fee”, and then the account is blocked.

In July 2026, I4C highlighted a case in which a retired scientist in Mumbai lost Rs 1.3 crore this way, Outlook Money reported. I4C’s advice: treat “guaranteed returns” and “VIP stock tips” as warning signs, install trading apps only from official stores, and check that the broker is genuinely registered.

The habit that stops it: no real broker asks you to pay extra to withdraw your own money.

3. Fake KYC, “account blocked” and reward-points messages

An SMS or WhatsApp message says your bank account, SIM or electricity connection will be blocked today unless you update KYC, or that your reward points are about to expire. It contains a link to a page that looks like your bank’s.

The RBI’s BE(A)WARE booklet lists phishing links and “vishing” calls, where scammers pose as bank officials, among the most common frauds. The urgency is the giveaway.

What to do: don’t tap the link. Open your bank’s app directly, or call the number printed on your card.

4. Fake customer care numbers

You search online for a bank, airline or delivery company’s helpline and call the first number you see. It’s run by scammers, who ask you to install a screen-sharing app “to help”, or to share an OTP for a “refund”.

What to do: get support numbers only from the company’s official app or website. Sanchar Saathi’s Trusted Contact Details service lets you check official contact details of banks and financial institutions. Our Sanchar Saathi guide explains how to use it.

5. UPI tricks: “scan to receive” and collect requests

You’re selling something online. The “buyer” sends a QR code or a payment request and tells you to scan it or enter your PIN to receive the money. Doing so actually sends money from your account.

NPCI’s UPI safety guidance is clear:

“UPI PIN is NOT required for receiving money.”
Scan a QR code only to make a payment, never to receive one.
Check the receiver’s name before you pay.
Don’t install screen-sharing or SMS-forwarding apps because a stranger asked you to.

6. Malicious APK apps and fake “updates”

A link in an ad or message asks you to install an app outside the Play Store: perhaps a “bank update”, a “document” or, in a campaign I4C flagged in August 2026, a fake adult-content app promoted through Facebook and Instagram ads. Once installed, the app asks for Accessibility or SMS permissions and uses them to take over your phone and approve payments, according to the advisory as reported by ANI.

What to do: install apps only from the Play Store or App Store, keep Google Play Protect on, and never give Accessibility permission to an app you don’t fully trust. If an app asks for that permission and has no clear reason to need it, uninstall it.

How to spot almost any scam: five red flags

Urgency or fear: “Your account will be blocked today”, “You are under arrest”.
Secrecy: “Don’t tell your family”, “Stay on the call”.
Too good to be true: guaranteed returns, prizes, easy part-time income.
A request to pay in order to get paid: fees, taxes or deposits to release money.
A request to install, scan or share: an app, a QR code, an OTP or a PIN.

Some apps now help spot these patterns. In August 2026, WhatsApp began testing a Scam Alert feature that uses an on-device model to flag suspicious messages from people who aren’t in your contacts, without sending message content to Meta, according to BleepingComputer. It was in limited beta at the time, so don’t count on it yet.

Where to report a scam in India

Lost money: call 1930 immediately and file a complaint at cybercrime.gov.in. See our full guide on what to do if you’ve lost money to online fraud.
Suspicious call, SMS or WhatsApp but no money lost: report it on Sanchar Saathi using Chakshu.
Promotional spam: report it through the TRAI DND app or 1909.

For more guides like this, visit our Cybersecurity and Privacy section.

Frequently asked questions

Can someone take money from my account just by calling me?

Not on their own. Scammers need you to do something: approve a UPI request, enter your PIN, share an OTP, install an app or click a link. That’s why hanging up is always safe.

Is it safe to share my OTP with a bank employee?

No. A genuine bank employee will never ask for your OTP, UPI PIN, card PIN or CVV. Anyone who asks is a scammer, whatever number they’re calling from.

Why do scammers know my name and bank details?

Personal details leak through data breaches, sold databases and social media. Knowing your name or bank doesn’t make a caller genuine.

How can I protect elderly parents from these scams?

Explain the five red flags, save the official helpline numbers in their phone, and agree on a rule that they’ll call you before paying anyone who contacts them unexpectedly. Turning on transaction SMS alerts also helps you both spot problems early.

Common Online Scams in India and How to Spot Them