Common online scams and how to avoid them

You are selling something online. The "buyer" is keen, and sends you a payment request that you have to approve with your UPI PIN. Approving it does not credit you — it debits you. A collect request is a request for money, and your PIN authorises the outgoing payment.

The rule is absolute and worth memorising: receiving money in UPI never requires your PIN, your fingerprint or a QR scan. If a screen is asking you to authorise anything, money is about to leave your account. Cancel and ask for a direct transfer to your UPI ID instead.

The same logic applies to QR codes. Scanning a QR sets up a payment from you. Nobody can pay you by making you scan something.

A message says a parcel is held for a small fee, or that customs has intercepted a package in your name. The fee is tiny on purpose — small enough that paying is easier than thinking, and the point is not the fee but the card details you enter on the payment page.

A more aggressive version is a phone call claiming a parcel in your name contained something illegal, followed by a transfer to a fake police officer. That call exists to keep you frightened and on the line. No genuine investigation is conducted by phone, and no real officer collects a fine over UPI.

Track deliveries only in the courier's own app or on the address you typed yourself. If nothing is pending there, nothing is pending.

"Your KYC has expired, your account will be blocked in 24 hours." The deadline is the whole product — it exists to stop you checking. Banks do not complete KYC over a phone call, an SMS link, or an app you were asked to install. Hang up, then call the number printed on your card or on the bank's official website. If the call was genuine, the bank will still be able to help you.

Any caller who wants you to install AnyDesk, TeamViewer, QuickSupport or similar is asking for control of your phone, including your banking app and the OTPs that arrive on it. This is the highest-damage scam in circulation because it defeats every other protection you have. No legitimate bank, telecom, marketplace or government department will ever ask for this. There is no exception to learn — just refuse.

A WhatsApp message offers well-paid work-from-home tasks. The early tasks pay out, which is what builds trust, and then a "deposit" is needed to unlock a larger batch. That deposit is the entire business model. Legitimate employers do not require payment from an employee.

Instant-loan apps promise money in minutes and demand access to contacts and photos at install. When repayment is late — often on terms that were never disclosed — those contacts are used to shame you. Borrow only from a lender registered with the RBI, and never grant contact or gallery access to a loan app.

Every scam here needs you to act inside its own channel: its link, its number, its app, its deadline. Break out of that channel and the whole thing collapses. Close the message, go to the company's official app or type its address yourself, and check whether the alarming thing is actually true. Doing that costs you two minutes on a real notification and saves you everything on a fake one.