OTP, UPI PIN and fake customer care: what a real sign-in never asks

A real betting sign-in asks you for two things at most: your phone number or email, and your password. It may send a one-time code to confirm a new device. It never asks you to read that code out to a person, never wants your UPI PIN, and never needs your screen. Every "customer care" call that asks for any of those is a fraud, however official it sounds.

OTP, UPI PIN and password: what each one is for

The three are often lumped together as "codes", but they do very different jobs. Knowing the job tells you who has a reason to ask.

An OTP is dangerous to share because the person asking has usually already started the action on their side. They are resetting your password or approving a payment from their phone, and your code is the last missing piece. Read the SMS text: it normally says what the code is for. "Do not share" is printed there for a reason.

A UPI PIN exists for paying, nothing else. Receiving money, whether a refund, a withdrawal or a "bonus credit", never involves your PIN. If a screen or a caller asks for it to send you money, the money is going the other way.

How fake customer care finds people

Fake support numbers are placed where people look when something has gone wrong: search results, map listings, YouTube comments, social media pages, Telegram channels. Someone types a brand name plus "customer care number", calls the first result, and reaches a scammer who already knows the script.

The calls follow a pattern. The caller is polite and quick, knows the brand's name and colours, and creates a deadline: "your account will be blocked in 30 minutes", "your withdrawal is stuck until you verify". Then comes the request. Read out the OTP that just arrived. Install an app so they can "check the problem". Pay a small fee to release a large amount. Approve a collect request to "confirm your UPI".

Betting adds its own version: "betting ID" sellers and "agents" on Telegram or WhatsApp who offer to open an account for you, take your deposit by UPI to a personal number and hold your login. Your money then sits with a stranger, and no one to take a complaint.

Signs that a sign-in page is not what it claims

Phishing pages copy the look of a site perfectly. The address is what gives them away, and it takes ten seconds to read.

• Read the domain letter by letter before typing anything. Swapped letters, extra hyphens, an added word such as "support" or "verify", or an unfamiliar ending are all warnings.
• Arrive by typing the address yourself or using a bookmark you created yourself; links arriving by chat or SMS do not count.
• A sign-in page that asks for your UPI PIN, Aadhaar number or card details is fake, full stop.
• A page that asks for an OTP you did not request is starting something you did not ask for.

Offshore betting sites do move between mirror addresses, which makes this harder. Mirrors are not something we advise you to hunt for; the point here is that a new address appearing in a chat message deserves more suspicion, not less. On an iPhone, once you have a sign-in page you trust, Safari's Share menu has "Add to Home Screen", which saves you from searching for the name every time.

Remote-access apps and screen sharing

No real support team needs to see your phone screen. Screen-sharing and remote-control apps are legitimate tools for IT work, which is why scammers like them: once installed and opened at their request, they can watch you type your PIN or read every OTP that arrives.

If a caller asks you to install one, hang up. If you already have one running, close it, uninstall it, and treat every code you received during the call as compromised.

The first 30 minutes after sharing a code

Mistakes happen, usually under pressure and late at night. What you do next matters more than the mistake itself.

1. Ring 1930, the Indian cyber fraud helpline, with the transaction details. Then file the complaint at cybercrime.gov.in.
2. Call your bank on the number printed on your card or passbook, not one from search results, and ask them to block UPI and cards on the affected account.
3. Change your UPI PIN and the email password linked to your bank and betting accounts.
4. Change the betting account password from the real site and sign out of all other sessions if the site offers it.
5. Keep screenshots of the caller's number, chat messages and any UTR of money that left. Do not delete the conversation.

Ignore anyone who rings later promising to get the money back for a charge. Such callers hunt for people who reported a loss days earlier.

One rule to remember

If someone else asks for a code, the answer is no. A password is typed only on a page whose address you checked; an OTP is typed only into the screen that sent it; a UPI PIN is typed only inside your own UPI app, to send money you meant to send. Everything outside that is a request you are entitled to refuse, and a real company will never punish you for refusing.

If the pressure around a betting account is coming from debts or losses rather than from a scammer, that is worth a call too. Tele-MANAS on 14416 is free and works 24/7.