10 Cybersecurity Tips Every Indian Should Know

Attack attempts you never see

India's national cyber agency, CERT-In, now handles well over a million cybersecurity incidents a year. Over a million. Cyber fraud losses reported to the government's cybercrime portal run into thousands of crores of rupees, and ransomware has hit hospitals, manufacturing companies and even municipal corporations. On top of that, the average Indian internet user runs into attack attempts constantly, though most of those get blocked by automated security systems long before they reach a person.

This is happening here, to people like us.

India has over 900 million internet users in 2026, one of the largest connected populations on the planet, and with UPI payments, digital banking, e-governance portals and online shopping all taking off at the same time, the attack surface for cybercriminals has grown enormously. CERT-In's advisories have flagged steady growth in phishing, ransomware and financial fraud.

What makes India especially exposed is how fast we went digital. Hundreds of millions of people came online for the first time during and after the pandemic, many of them on a smartphone that's their primary (often only) computing device. Plenty of these users haven't had years of practice spotting scams. Criminals know this.

Most attacks go after easy targets, though. That's good news. A few practical habits cut your risk dramatically. Here are 10 tips put together for Indian internet users, plus what to do if something goes wrong anyway.

---

1. Use a strong, unique password for every account

Reusing passwords is probably the biggest security mistake people make. Simple as that. One service gets breached, and attackers try the same credentials on your email, bank and social media. That's credential stuffing, and it's automated and devastatingly effective, because databases of leaked passwords are freely traded on dark web forums, and bots test millions of username-password combinations against popular services within hours of a breach.

What I'd do:

• Get a password manager like Bitwarden (free and open-source) or 1Password. It generates and stores a complex, unique password for every account, so you only have to remember one master password.
• Make passwords at least 16 characters long, with a mix of letters, numbers and symbols.
• Keep personal information like your name, birthdate or phone number out of passwords. Attackers can pull all of that from social media profiles and data broker sites.
• Try passphrases instead of traditional passwords. Something like "mango-rickshaw-monsoon-cricket" is easier to remember and harder to crack than a shorter, more complex password like "M@ng0#21".

So how does a password manager work? It auto-fills your credentials when you visit a website. New account? It generates a random, strong password and saves it. Your vault is encrypted with your master password, which never leaves your device, so even if the password manager's servers were breached, the attackers would only get encrypted data that's useless without that master password.

---

2. Turn on two-factor authentication (2FA) everywhere

Passwords alone won't cut it. Turn on two-factor authentication on every account that supports it, starting with email, banking and social media.

• Pick authenticator apps (Google Authenticator, Authy or Microsoft Authenticator) over SMS-based OTPs, because SIM-swapping is a real threat in India. In a SIM-swap attack, the criminal convinces your telecom provider to move your phone number to a new SIM card, and from then on your OTPs go to them.
• For critical accounts, consider a hardware security key like YubiKey. It's a physical device, the strongest form of authentication available, and immune to phishing.
• Save your backup codes. Most services hand you one-time backup codes when you enable 2FA. Store them somewhere safe (your password manager, not a screenshot on your phone), because if you lose access to your authenticator app, those codes are your only way back in.

SIM-swapping deserves extra attention here in India. Criminals use social engineering, forged documents or even bribed telecom store employees to port your number, and once they have it they can intercept OTPs sent over SMS and get into your bank accounts, email and social media. An authenticator app takes SMS out of the picture and closes that hole completely. Easy switch. Big payoff.

---

3. Be extremely careful with UPI and digital payments

UPI has changed how India pays for things. Massively. It's also a major target for scammers. In 2025, UPI fraud cases rose by over 30% compared to the previous year. The usual tricks:

• Fake payment requests. Scammers send a "collect" request dressed up as a refund. You never need to approve a request to receive money. If someone says they're sending you money and asks you to approve something, it's a scam, every single time.
• Screen sharing scams. Fraudsters posing as bank support ask you to install screen-sharing apps like AnyDesk or TeamViewer. Don't. Once they can see your screen, they watch you type your UPI PIN and move money out of your account.
• Fake customer care numbers. Get support numbers from the company's official website or app, never from Google search results, because scammers pay for Google Ads so their fake numbers sit right at the top of the page where you're most likely to tap them. Sneaky.
• QR code scams. Fraudsters send QR codes and say you need to scan them to receive money. Scanning a QR code starts a payment FROM your account. Never TO it. Never scan a QR code to receive money.
• Fake payment screenshots. Scammers show you a doctored screenshot of a "completed" payment. Always check your own UPI app before handing over goods or services.

The golden rule: no bank or payment service will ever ask for your UPI PIN, OTP or password over a call or message. Anyone who asks? Hang up. Immediately.

Fell for a UPI scam? Act within the first 30 minutes. Call your bank's customer care (the number on the back of your debit card, not one from Google), ask for a temporary block on your account, and file a complaint on the National Cyber Crime Reporting Portal. Under RBI guidelines, if you report within 3 working days and the fraud wasn't due to your negligence, you may be eligible for a full refund.

---

4. Protect your Aadhaar and PAN data

Treat your Aadhaar number and PAN like passwords. In the wrong hands they get used for identity theft, fraudulent loan applications, SIM card activation and opening bank accounts in your name. I think most people don't realize how much damage a leaked Aadhaar number can do.

• Lock your Aadhaar biometrics through the UIDAI website or the mAadhaar app when you're not using them. That blocks unauthorized biometric authentication. You can unlock them temporarily when you need biometric verification, then lock them again.
• Share a masked Aadhaar (it hides the first 8 digits) whenever someone needs a copy for KYC or verification. The masked version is legally valid for most purposes.
• Don't post photos of your Aadhaar or PAN on social media or send them over messaging apps. Once an image is out on WhatsApp or Telegram, you've lost control of who sees it.
• Check your Aadhaar authentication history at resident.uidai.gov.in every so often. It shows every time your Aadhaar was used for authentication, which helps you catch misuse.
• Use your Aadhaar Virtual ID (a 16-digit temporary number that maps to your Aadhaar) instead of the real number whenever you can. You generate it from the UIDAI website. Revoke and regenerate it any time.

A common scam is a caller claiming to be from "Aadhaar verification" or "UIDAI" who wants you to update your Aadhaar details over the phone. UIDAI doesn't call. Aadhaar updates happen only online or at official Aadhaar enrolment centres. Period.

---

5. Keep your devices and apps updated

Updates patch security holes. Put them off and your devices stay open to known exploits, and once a vulnerability is publicly disclosed, attackers start scanning the internet for unpatched devices, sometimes within hours.

• Switch on automatic updates for your smartphone, laptop and every installed app.
• Watch updates for your browser, operating system and banking apps most closely. The browser matters a lot, because it's your gateway to the internet and gets targeted all the time.
• Uninstall apps you don't use anymore. Each one is a way in. That app you installed once and forgot about could be collecting data in the background, and if it stops getting updates, its known vulnerabilities stay unpatched forever.
• Check app permissions regularly. Go into your phone's settings and look at which apps can reach your camera, microphone, location, contacts and storage, then revoke anything an app doesn't need for its core job. A calculator app has no business with your contacts or location.
• Be careful with sideloaded APKs (Android apps installed from outside the Play Store). They skip Google's security scanning and may carry malware. If you must sideload, stick to sources you trust completely.

---

6. Watch out for phishing

Phishing keeps getting better. We have a detailed guide on how to spot phishing scams targeting Indian users if you want to go deeper. In India, the usual suspects are:

• Fake messages from "SBI," "HDFC," or other banks claiming your account is blocked.
• Emails pretending to be from the Income Tax Department during filing season.
• WhatsApp messages offering fake government subsidies or job opportunities.
• Fake e-commerce delivery notifications with links to "track your parcel."
• Messages about "winning" a lottery or a prize from a company like Reliance or Tata.

How to spot them:

• Check the sender's email address carefully. Official emails come from domains like @sbi.co.in, not @sbi-alerts.com or @sbi.security-update.in.
• Hover over links before clicking to see the real URL. On mobile, long-press the link to preview it without opening it.
• Look for spelling errors and urgent language ("Your account will be closed in 24 hours!"). Legitimate organisations rarely try to panic you like that.
• When in doubt, type the official website's URL into your browser yourself instead of clicking anything.
• Be extra careful during tax filing season (July-September), festival sales (October-November), and right after major data breaches, when attackers have fresh personal data for targeted phishing.

AI has made this worse. In 2026, attackers use AI tools to write phishing messages without the spelling errors and awkward phrasing that used to give them away, and they personalize them with public data from social media profiles, so they're more convincing than ever. The best defence is simple. Never click links in messages you weren't expecting, however legitimate they look. I suspect it'll get worse before it gets better. Nothing I can see right now is going to change that.

---

7. Use a VPN on public Wi-Fi

Free Wi-Fi at cafes, airports and hotels? Convenient, but also risky. Attackers on the same network can intercept your traffic and steal login credentials through man-in-the-middle attacks. They can also set up fake hotspots with names like "Airport_Free_WiFi" that look legitimate but route everything you do through the attacker's device.

• Use a reputable VPN service whenever you're on public Wi-Fi. ProtonVPN (which has a free tier) and Mullvad are trustworthy options. If you want to shrink your digital footprint further, look at our list of privacy-focused app alternatives that collect less data.
• Skip banking apps and transactions on public networks, even with a VPN. Not worth the risk.
• If you have to use public Wi-Fi without a VPN, make sure every site you visit uses HTTPS (the padlock icon in the address bar). Never type passwords or financial information into HTTP (non-encrypted) websites.
• Turn off Wi-Fi auto-connect on your phone. Many phones join open networks automatically, which means yours could hop onto a malicious hotspot without you noticing.
• Use mobile data instead of public Wi-Fi for anything sensitive. With Jio and Airtel offering affordable data plans, mobile data is often faster and safer than public Wi-Fi anyway.

---

8. Secure your home Wi-Fi network

Your home router is the gateway to every connected device you own. If it's poorly secured, neighbours or drive-by attackers can exploit it. For a full walkthrough of router settings, network segmentation and firewall configuration, see our complete home network security guide.

• Change the router's default admin password. Default credentials are public for every router model; a quick Google search of your model number turns up the username and password. If you've never changed them, anyone who looks up your model can log straight in.
• Use WPA3 encryption if your router supports it, and WPA2 otherwise. Never use WEP, which can be cracked in minutes with freely available tools.
• Pick a strong Wi-Fi password, different from the router admin password and at least 12 characters long.
• Set up a guest network for visitors instead of handing out your main password. Most modern routers support this. Keep it isolated from your main network so guest devices can't reach your computers, NAS drives or smart home devices.
• Update your router's firmware every so often. Manufacturers release firmware updates that fix security holes, but unlike phones, routers don't update themselves, so it's on you to log into the admin panel every few months and check whether a new version is waiting.
• Disable WPS (Wi-Fi Protected Setup). WPS lets devices connect with a PIN or a button press, but the PIN mechanism has known vulnerabilities that let attackers brute-force their way in.

---

9. Back up your data regularly

Ransomware encrypts your files and demands payment for the decryption key. In India, ransomware attacks rose by over 50% in 2025. Big companies weren't the only victims. Small businesses, hospitals and individual users got hit too. Regular backups are your way out: even if your files get encrypted, you restore them from a clean copy and never pay the ransom.

• Follow the 3-2-1 backup rule: 3 copies of your data, on 2 different media types, with 1 copy stored offsite (cloud).
• Use services like Google Drive or OneDrive, or an external hard drive.
• Test your backups now and then to make sure they really restore. A backup that can't be restored is just a false sense of security.
• For critical data, consider versioned backups that keep several versions of each file. They save you when ransomware encrypts your files and the encrypted copies sync to cloud storage before you notice.
• Back up photos, important documents (Aadhaar, PAN, educational certificates, property documents), financial records and any work files. Most people who lose years of family photos to ransomware lose them because they never backed up their phone's camera roll. Don't let that be you.

Running a small business? I'd invest in an automated backup solution that runs daily without anyone touching it. A backup solution costs Rs 500-2,000 per month, which is nothing next to the average ransomware demand (Rs 5-50 lakh for small businesses) plus the cost of lost business data.

---

10. Educate your family

You might be tech-savvy. Great. Your mother might not be, and cybercriminals usually go after the weakest link in a household, which tends to mean elderly parents and young children. In India, a disproportionate number of financial fraud victims are above 50 years of age. They may be less familiar with digital scam tactics, and scammers know exactly how to exploit that.

• Teach your parents to verify anyone who calls claiming to be from a bank or government agency. Make it a family rule: if someone calls asking for money, personal information or access to your phone, hang up and call back on the official number from the bank's website or the back of your debit card.
• Set up parental controls on devices your kids use. Android and iOS both have built-in parental controls that limit screen time, block inappropriate content, and stop unauthorised app installs and purchases.
• Talk about online safety regularly, using real scams from the news. A specific news story about a local scam lands far better than abstract warnings about "being careful online."
• Help family members set up password managers and 2FA, walking them through it step by step until they can manage on their own.
• Make a family security checklist. Lock Aadhaar biometrics for everyone in the household. Turn on 2FA for all bank and email accounts. Install a password manager on everyone's phone. Set up automatic backups for photos and important documents. Review app permissions together once a quarter.

---

Bonus: securing your social media accounts

Social media accounts are frequent targets. They hold exactly the personal information that's useful for identity theft and social engineering. What I'd set up on each:

• On Instagram and Facebook, enable 2FA, review login activity regularly (Settings > Security > Login Activity), and remove connected apps you no longer use. DMs from accounts claiming to be Instagram support are always scams.
• On WhatsApp, enable two-step verification (Settings > Account > Two-step verification), which adds a PIN when your number is re-registered. Never share your WhatsApp verification code with anyone, even someone claiming to be from WhatsApp.
• On LinkedIn, limit what personal information shows on your profile and hide your phone number and email address from public view. Scammers use LinkedIn data to write targeted phishing emails that mention your job title and company.
• On X (formerly Twitter), use an authenticator app for 2FA, since SMS-based 2FA is no longer free on X. Review connected apps and revoke access for any you don't recognise.

---

What to do if you're a victim

If you think you've been hit by a cyberattack or financial fraud:

1. Report it immediately on the National Cyber Crime Reporting Portal at cybercrime.gov.in or call the helpline 1930. The sooner you report, the better your chance of getting lost money back. The 1930 helpline runs 24/7 and can trigger an immediate freeze on the recipient's bank account.
2. Contact your bank and freeze your account if there's unauthorized financial activity. Most banks have 24/7 customer care numbers just for reporting fraud.
3. File a complaint at your local police station too. Specialised cells handle cyber crimes. Still, a local FIR on record strengthens your case.
4. Change passwords for every compromised account from a different, trusted device. If your email was compromised, change that password first, because attackers often use email access to reset passwords everywhere else, and every other account you lock down is only as safe as the inbox that receives its reset links.
5. Keep a close eye on your accounts for the next several weeks. Attackers sometimes make small test transactions before bigger thefts, or wait days or weeks before using stolen credentials.
6. If your Aadhaar or PAN was compromised, check CIBIL (cibil.com) for loans or accounts opened in your name, and lock your Aadhaar biometrics immediately.

Three things to do today

That's a lot. You won't do it all in one sitting, and that's fine. These three, done today before you close this tab, make the biggest immediate difference:

1. Install a password manager (Bitwarden is free) and start changing your most important passwords: bank account, email, UPI app. You don't have to do every account today. Start with the ones that matter most. It takes maybe 20 minutes.

2. Enable 2FA on your email and bank accounts with an authenticator app, not SMS, since your email is the master key to everything else and whoever gets into it can reset every other password you have. Lock it down.

3. Lock your Aadhaar biometrics through the mAadhaar app. Takes 30 seconds. You can unlock them whenever you need biometric verification, and there's no reason to leave them unlocked 24/7.

Those three steps put you ahead of most Indian internet users on security. Your family's security ends up being yours too, so the parents and relatives who click every WhatsApp link are worth walking through the same three steps.