Scams, myths and investor protectionModule 2, lesson 9 of 15
Impersonation, phishing and account security
How fraudsters pose as brokers, advisers and regulators, how phishing messages steal logins and OTPs, and the habits that keep your trading and demat accounts safe.
In this lesson
- Recognise impersonation of brokers, advisers, celebrities and regulators.
- Pick out the warning signs in a phishing message.
- Explain why OTPs, PINs and remote-access apps must never be shared.
- Set up the basic security habits that protect a trading and demat account.
Builds on
- Unregistered and unauthorised intermediariesImpersonators pretend to be the registered intermediaries described there.
On this page
In simple terms
The simplest way to steal from an investor is not to beat them in the market. It is to pretend to be someone they trust, their broker, a well-known adviser, a celebrity or the regulator, and persuade them to hand over money, login details or control of their phone.
Impersonation is pretending to be a real person or organisation. Phishing is using a fake message, website or call to trick someone into revealing information such as passwords and one-time passwords (OTPs). They usually work together.
Who gets impersonated
Brokers. Fake websites and apps copy a real broker's name, logo and layout, sometimes with a web address that differs by one letter. Fake "customer care" numbers appear in search results and on social media.
Advisers and creators. Fraudsters copy the photos and name of a well-known adviser or creator, set up a lookalike profile or group, and offer tips or "premium services".
Celebrities and business leaders. Edited or deepfake videos show famous people apparently recommending a trading app or scheme.
Regulators and officials. Callers claim to be from SEBI, the stock exchange, the police or a tax office. Typical stories: your account is under investigation, money is stuck and needs a "release fee", or a penalty must be paid immediately.
Everything they show you, the logo, the name, an ID card, a letter with a seal, an official-looking email address, can be copied or faked.
Anatomy of a phishing message
Worked example: A message pretending to be a broker
A made-up broker, Nivesh Securities, has customers who receive this SMS:
"Dear Customer, your Nivesh trading account is suspended due to incomplete KYC. Update within 2 hours to avoid permanent block: nivesh-kyc-verify.co/login"
The warning signs:
| Feature | Why it is a warning sign |
|---|---|
| "Dear Customer" | A real broker's message usually uses your name or client ID |
| "Suspended", "permanent block" | Fear is used to make you act before thinking |
| "Within 2 hours" | A deadline leaves no time to check |
| A link to log in | Real firms ask you to use their app or website, not a link in a text |
| An address that is not the broker's own | Anyone can register a name that includes a company's name |
The page behind the link looks like the broker's login screen. Whatever you type, user ID, password, PIN, OTP, goes straight to the fraudster, who logs in to your real account.
What must never be shared
OTPs, PINs and passwords. An OTP is sent to you to prove that you are approving something, such as a login, a payment or a transfer of shares out of your demat account. Anyone who asks you to read it out is asking for permission to act as you. Genuine staff never need it.
Remote access to your phone or computer. Screen-sharing and remote-control apps let the other person see everything you type and act on your device. Fraudsters ask you to install one "to help fix a problem" or "to guide you through trading".
Your SIM. If a fraudster gets a duplicate of your SIM card, often called a SIM swap, they receive your OTPs. If your phone suddenly loses signal for no clear reason, contact your mobile operator and your bank quickly.
Habits that protect your account
- Go direct. Reach your broker, depository or SEBI by typing the address yourself, or by using the app from the official app store, found through the firm's own website.
- Turn on two-factor authentication, which needs a second proof, such as an OTP or an authenticator app, as well as your password, and lock your trading app with a PIN or your fingerprint.
- Keep your own contact details registered with your broker and depository, so alerts reach you and not someone else.
- Read every alert and statement. Brokers send contract notes after each trading day, and depositories send alerts and statements when shares move. A trade or transfer you did not make is an emergency.
- Use a strong, different password for your trading account and email, and a password manager if you can.
- Hang up and call back. If a caller claims to be from your broker, a bank or a regulator, end the call and contact the organisation through its official number, found yourself.
If you think your account has been taken over, contact your broker immediately through its official channels, change your passwords, and follow the steps in the verify and report lesson.
Why it matters
Market losses are a risk you choose. Losses from a stolen account are not, and they can be total and fast: a fraudster with your login and OTP can sell your shares, move money or place reckless trades within minutes. A few habits close almost all of these routes.
Limitations
Security habits reduce risk; they do not remove it. Fraud methods change, and convincing fakes, including AI-generated voices and videos, are getting better. The principles in this lesson stay the same: verify through channels you find yourself, and never share codes or control of your device. If something feels wrong, stop and check.
Common mistakes
- Trusting a caller because they know your name or account details. Personal data leaks are common; knowledge is not proof of identity.
- Searching for "customer care" and calling the first number. Fraudsters advertise fake numbers.
- Sharing an OTP "to cancel a transaction". The OTP is what approves it.
- Installing an app from a link sent in a chat or SMS.
- Ignoring alerts because there are many of them. One unfamiliar alert can be the first sign of a takeover.
Try it yourself
Take ten minutes to secure your own accounts:
- Check that two-factor authentication and an app lock are turned on for your trading app.
- Confirm that the mobile number and email registered with your broker are your own and current.
- Find your broker's official website and customer care number by typing the address yourself, and save them in your phone.
- Look at your last contract note and depository statement, and check that every entry is yours.
Key takeaways
- Logos, names, photos and official-sounding language are easy to copy. They prove nothing about who is contacting you.
- Never share an OTP, PIN or password, and never install a screen-sharing or remote-access app because someone asked you to. Genuine firms and regulators do not ask for them.
- Reach your broker, depository or SEBI by typing the address yourself or using the app from the official app store, never through a link in a message or a number from a search advert.
- Turn on two-factor authentication, keep your own mobile number and email registered with your broker and depository, and read every alert and statement.
- Regulators do not phone investors demanding fees, taxes or penalties to release money.
Check your understanding
Finished reading?
Your progress is saved only in this browser.
Terms used in this lesson
- Phishing
- Using a fake message, website or call that appears to come from a trusted organisation to trick someone into revealing passwords, OTPs or other details.
- Two-factor authentication
- A login that needs a second proof, such as a one-time password or an authenticator app code, as well as your password.
- Demat account
- An account that holds your shares and other securities in electronic form, maintained with a depository through a depository participant.
- Stockbroker
- A SEBI-registered member of a stock exchange that sends investors' buy and sell orders to the exchange.
References
- Beware of fake trading app scam, SEBI investor website. SEBI's warning about fake trading app scams.
- Central Depository Services (India) Limited, CDSL. One of India's two depositories, which keep demat account records.
- National Securities Depository Limited, NSDL. The other depository.
- National Cyber Crime Reporting Portal, Ministry of Home Affairs, Government of India. The government's national portal for reporting cyber crime.
Spotted a mistake or something unclear? Report it by email. Here is how corrections work.
This lesson is general education, not investment advice. Examples use made-up or clearly dated figures to explain ideas; they are not recommendations. Read the disclaimer.