You receive a phone call. The person says they are calling from your bank and need to verify your account. They say an OTP has been sent to your phone and ask you to tell them the OTP.
Suspicious call example
Caller: I'm calling from your bank.Caller: We need to verify your account.Caller: An OTP has been sent to your phone. Please tell me the OTP.Your Secret Codes Stay With You
This should immediately make you suspicious.
Your Digital Secrets
Some information should be treated like the keys to your house.
- Password
- Protects your account.
- OTP
- Confirms that you are authorizing an action.
- UPI PIN
- Authorizes UPI payments.
- CVV
- Helps authorize card transactions.
- Recovery Code
- Can sometimes be used to regain access to your account.
Real-Life UPI Scam
UPI scam example
Scammer: I'm sending you Rs. 5,000.Scammer: Scan this QR code and enter your UPI PIN to receive the money.Stop. In normal UPI use, your PIN is used when you authorize a payment, not simply because someone is sending money to you. Always read the payment screen carefully.
Another Common Scam
Fake customer support may ask you to install an app so they can help fix your issue. Then they may ask you to share your screen, read out an OTP, enter your PIN, or give remote access to your phone.
At this point, they may be trying to take control of your account or payment.
Simple Rule
Never share these details with anyone.
- Password
- OTP
- UPI PIN
- Recovery code
Be very cautious with CVV, card details, screen sharing, and remote-access apps.
If someone claiming to be from a bank or company asks for these details, end the conversation and contact the company using its official app, website, or verified phone number.
Remember
OTP means authorization. UPI PIN means authorization. Your secret codes stay with you.
Series
Internet Security Basics: 10-Part Series for Everyday UsersA 10-part series for everyday users to identify scams, protect accounts, and use the internet with more confidence.
Is This Email Really From Your Bank or Company?
Check sender names, email addresses, and urgent payment messages before trusting them.
Can You Spot the Real Website?
Learn how fake domains, confusing links, and lookalike names trick everyday users.
HTTPS Does NOT Mean the Website Is Genuine
Understand what the lock symbol protects, and why you still need to verify the domain.
Does a Professional Domain Extension Mean the Website Is Genuine?
Learn why .com, .org, .in, .net, and .ai do not automatically prove trust.
The Link Says SBI, But Where Does It Actually Go?
Learn why visible link text and button labels can hide a completely different destination.
Sir, Please Tell Me the OTP for Verification
Learn why OTPs, passwords, UPI PINs, recovery codes, and remote access must stay private.
Scan This QR Code to Receive Your Refund
Learn how QR codes can hide payment requests, fake links, and UPI PIN traps.
Someone Sent You BankKYC.apk on WhatsApp. Should You Install It?
Learn why APKs, cracked software, and fake apps can hide malware or dangerous permissions.
Which Airport Wi-Fi Is the Real One?
Learn how fake public Wi-Fi names and captive portals can trick users into unsafe logins.
Before You Click, Pay or Login, Take 30 Seconds
Use a quick checklist before reacting to urgent messages, links, payments, or login prompts.
Nikhlesh Yadav is a Technical Lead and Solution Architect with 12+ years of experience across cloud-native systems, distributed platforms, AI integrations, Web3, and cyber security.
Read full profile