The smartphone in most Indians’ pockets today is no longer just a communication device. It holds banking applications, UPI handles, saved card details and one-tap access to savings that once required a bank visit to move. That convenience has made it the single most attractive target for cybercriminals operating at industrial scale.
The numbers explain the urgency. Indians lost an estimated ₹22,495 crore to cyber fraud in 2025, with complaint volumes jumping 24 percent to roughly 2.81 million cases even as the total amount stolen stayed flat against the previous year. Government data tabled in the Lok Sabha shows UPI-linked fraud alone crossed ₹805 crore in the first eight months of the current financial year, spread across more than 10.64 lakh incidents. Experts caution that these figures likely understate the real picture, since a LocalCircles survey found that roughly one in five UPI-using households has faced fraud, and more than half of victims never filed a formal complaint.
Locking Down the Device Itself
The first line of defence begins before a banking app is even opened. Security researchers advise reviewing what permissions payment applications actually need, and withdrawing access to contacts, SMS or the camera when an app has no genuine use for them. Biometric authentication, whether fingerprint or facial recognition, should be switched on for both the device and individual banking applications, since it adds a layer of protection that a stolen PIN alone cannot bypass. Shortening the auto screen-lock to thirty seconds or less further narrows the window in which a lost or unattended phone can be misused.
Alerts, Limits and Card Controls
Inside the banking app itself, transaction alerts deserve particular attention. Enabling SMS and email notifications for every debit, credit and login attempt allows a user to catch unauthorised activity within minutes rather than days. Setting conservative daily limits on UPI transfers, internet banking and ATM withdrawals similarly caps the potential damage if credentials are ever compromised, while disabling international transactions and contactless tap-and-pay features that are rarely used closes off two channels criminals frequently exploit.
Two-factor or multi-factor authentication, wherever a bank offers it, should be treated as non-negotiable rather than optional. Periodically checking the “linked devices” or “active sessions” section of a banking app is equally important, since an unfamiliar device listed there is often the earliest visible sign that an account has already been breached.
The Human Element Remains the Weakest Link
Public Wi-Fi networks and unsolicited screen-sharing requests round out the list of everyday risks. Financial transactions should never be conducted over open Wi-Fi, and the auto-connect option should be disabled so a phone does not silently join an unknown network. Accessibility permissions and screen-sharing tools should never be granted to unfamiliar applications, since these are precisely the mechanisms criminals use to watch OTPs and PINs being entered in real time.
According to Prof. Triveni Singh, a former IPS officer and one of India’s most recognised cybercrime investigators, criminals today succeed far more often by exploiting human trust than by breaching technical systems. He points to fake APK files, screen-sharing requests and phishing links as the tools most commonly used to empty bank accounts, and urges users to download banking applications only from official app stores, avoid clicking unsolicited links, and independently verify instructions before authorising any high-value transfer.
Should fraud occur despite these precautions, speed matters more than almost anything else. Reporting immediately through the National Cyber Crime Helpline at 1930 or the National Cyber Crime Reporting Portal significantly raises the odds of freezing a fraudulent transaction before the money moves beyond reach, a fact borne out by the ₹5,489 crore in fraudulent funds that agencies managed to recover in 2025 through rapid intervention. As India’s digital payments ecosystem continues to expand into smaller towns and first-time users, that gap between a routine mobile setting and a genuine financial loss is likely to remain the difference that matters most.
