Protecting Our Money from Cyber Scammers and Mobile Hackers

Last Updated on July 25, 2026 at 8:03 am

A reader asks, “All these years, you have taught us how to save and invest. I have saved and invested for the last 8 years, and I am truly scared when I hear about all the new types of scams. How do we safeguard our savings and investments in this era of Cyber scammers and mobile hackers? Kindly share your thoughts.”

Most investments now work in a closed-loop format. Investments can be made only from a user-approved bank account, and redemptions can only be returned to the same account. In addition, both redemptions and investments may require OTP approval.

So those channels are reasonably secure unless the user exposes all their passwords to others. Even if a password manager is used, OTP approval (ideally from another isolated device – see below) will ensure good safety.

All the basic safeguards are in place to protect even the casual or careless investor, so there is no need to lose sleep over it.  That said, if we go by the axiom that only the paranoid survive, we can be more careful.

Invest in good malware/spyware/virus protection for all your devices. Do not click on any link, even from a known email address. Always hover over the link and inspect it. A common way to attract your attention is via email spoofing. That is, a hacker sends an email with a malicious link, and the email seems to be coming from you! Always check

Over the years, technology has integrated utilities. Our mobile phone is now a computer with the Internet, so much so that more and more people are doing everything on their mobile phones. This is convenient on the go, but also brings security issues.

We access our bank accounts, MF and demat accounts, and UPI apps on the same device where we casually browse, use social media, etc. I would strongly recommend against this.

Do not install any financial apps on your smartphones (unless there is no web version, which is rare). Always access your investments on a computer confined to your house.

Two-factor authentication is important, but it should be across two devices. You log in via a computer (desktop/laptop) and get the authentication key or OTP on your mobile.

Ideally, I would prefer using feature phones for OTPS and a separate phone for social media and other browsing requirements. But this may seem like overkill for many. At the least, do not install financial apps on your phone unless they are essential.

Password management: In today’s world, writing passwords in a notebook (hard copy) is impractical, as many financial sites mandate regular password changes. Using the same password for all sites is also quite dangerous. So, a password app is mandatory.

There are many discussions online about which app is better, which app has never been hacked, etc. You will have to take a leap of faith and choose one. Enable two-factor authentication to ensure better security.

I recommend that retirees use two bank accounts: one that holds bulk cash and where investments and redemptions are made, and another for sundry expenses. These can be linked to UPI apps for everyday use.

Never install remote desktop tools (e.g., AnyDesk, TeamViewer, RustDesk) at the request of a caller — they grant scammers complete control over your screen and OTPs.

If you wish, you can set a SIM PIN in your phone settings to block unauthorised access if your phone is stolen, and report sudden loss of mobile network signal immediately to rule out SIM Swap fraud.

Do not install apps from unknown sources (there is such a setting in your phone) and check your apps from time to time for any unknown installs.

Lower your default daily limits for UPI, NEFT, and IMPS, and disable international or online usage on debit cards if you do not use them regularly (or turn on as needed and turn it back off)

Immediate Fraud Reporting: In case of an incident, call the official Helpline at 1930 or report at cybercrime.gov.in as soon as possible.