Online Scam Verification: Stop, Check, Report

Recognize pressure and identity signals

A scam is not defined by one spelling error or a suspicious-looking logo. Treat the combination of an unexpected contact, an urgent consequence, a request for secrets or money, and a demand to use a new payment or login path as a high-risk signal. CISA lists urgent language, requests for personal or financial information, shortened URLs, and look-alike addresses among common phishing signs. It also warns that polished grammar no longer proves legitimacy because artificial intelligence can produce convincing text. [6] [5]

Impersonation can appear in email, SMS, social messages, voice calls, video calls, search results, or a conversation that begins on a legitimate platform. Caller ID, a verified badge, a familiar name, a professional uniform, or an official-looking document is context, not independent proof. The question is whether the request can be checked using contact details and account access obtained without relying on the message itself.

• Mark the request as unverified if it asks for an OTP, PIN, password, remote access, identity document, secrecy, or an immediate transfer.
• Treat a demand to move money to a ‘safe’ account, buy gift cards, send cryptocurrency, or pay a fee to avoid arrest as a stop signal. FTC guidance says threats to transfer money to protect it are a scam pattern. [5]
• Do not let a caller’s knowledge of a real name, address, employer, family member, or recent purchase substitute for verification.

Use a three-channel verification habit

First, pause and preserve the request. Do not click, reply, call the displayed number, install software, or approve a payment while the claim is unverified. Second, identify the organization or person the sender claims to represent, but treat that identity as a hypothesis. Third, open a known app or type a known web address yourself, use a statement or card to find the institution’s contact route, or call a trusted person using a number already saved. CISA specifically recommends finding contact information on a verified website or using another route to confirm a message. [6]

Verification should test the specific request, not merely ask whether the organization exists. Ask whether the account, invoice, parcel, case, login alert, or payment instruction is real. A genuine organization may still have a compromised account, and a real invoice can be altered. Keep the original message separate from the independently sourced contact path so the evidence shows what was claimed and how it was checked.

• Use two independent facts when possible: a known account statement plus a known phone number, or a service’s official app plus a saved contact.
• Do not use a link, phone number, QR code, or attachment supplied by the suspicious contact as the verification channel.
• If a request cannot tolerate a short delay for checking, that is a reason to delay it, not a reason to trust it.

India decision tree: respond to a suspected digital-arrest scam

The Indian Cyber Crime Coordination Centre describes a pattern in which callers impersonate police, CBI, the Narcotics Department, RBI, the Enforcement Directorate, or other authorities; allege a parcel, identity document, account, or relative is linked to crime; keep a victim on a video call; and demand money to settle the invented case. The Ministry of Home Affairs has described the same pattern as intimidation, blackmail, extortion, and ‘digital arrests.’ [3] [4] The official I4C advisory states that real law enforcement will not arrest someone digitally and that there is no concept of digital arrest under Indian laws. [3]

Use this decision tree as a calm interruption, not as a legal conclusion. If there is an immediate physical safety emergency, contact local emergency services. For a suspected cyber financial fraud in India, call 1930 promptly and use the National Cyber Crime Reporting Portal. The portal is intended for cybercrime complaints and says accurate details matter; I4C says its financial-fraud system connects law-enforcement and financial stakeholders for rapid reporting, but neither source guarantees that money will be recovered. [1] [2]

• **Threat of arrest, seizure, investigation, or a relative in custody?** Stop the call or meeting. Do not transfer money, share OTPs or PINs, install an app, or remain on a demanded video call. Say nothing that confirms sensitive details. [3]
• **Need to check the identity?** End the contact and independently call the nearest police station or the institution through a number found outside the message. Do not call back through the displayed caller ID or supplied link. I4C advises independent identity verification and speaking with relatives before transferring money. [3]
• **No money sent and no sensitive data shared?** Save the message, number, profile, URLs, documents, timestamps, and call details; report the contact through the platform and consider reporting it to cybercrime authorities. Do not continue engagement to gather more material.
• **Money, card details, UPI details, or account access provided?** Stop further transfers, contact the bank, wallet, card issuer, or payment intermediary using its official channel, and ask what immediate protective action is available. Call 1930 and file or complete the report at cybercrime.gov.in. [1] [2] [7]
• **A 1930 acknowledgement or login ID received?** Follow the portal instructions promptly. The published citizen instructions say a complainant using the helpline must complete portal registration within 24 hours; confirm the current instruction during reporting because procedures can change. [2]
• **A caller says 1930, police, or the portal will ‘recover’ money only after another fee?** Stop. Treat a follow-on recovery demand as unverified and contact the bank and official portal independently. The sources establish reporting routes, not a guaranteed outcome.

Preserve evidence without spreading the scam

Evidence should show what happened, when it happened, what was requested, and what action followed. Keep the original email, chat, SMS, call log, social profile, payment receipt, bank alert, transaction reference, QR image, supplied document, and relevant URL where safe. Record the date, time zone, channel, displayed number or account, claimed identity, exact demand, and any independently verified response. Screenshots can help, but retain the original message or export when the service permits it because screenshots may omit metadata or context.

Do not forward a suspicious attachment to friends or upload private identity documents to public forums. If a device may have been accessed remotely or malware may have been installed, stop using it for sensitive logins and seek trusted technical help. For organizational incidents, CISA recommends retaining logs from network devices, hosts, and cloud services and preserving volatile evidence before actions that could erase it. [8] For an individual scam, the safe balance is to preserve what is available without taking risky forensic steps.

• Record transaction IDs, bank or wallet names, UPI or merchant identifiers, transaction dates, and relevant screenshots; the Indian reporting instructions list these as useful complaint information. [2]
• Keep a timeline that separates observed facts from your interpretation: ‘received call at 14:10’ is a fact; ‘caller was police’ is a claim made by the caller.
• Share evidence only with the bank, platform, cybercrime portal, police, or a trusted responder that needs it. Redact unnecessary account and identity numbers when sharing copies.

If payment or account access already happened

Speed matters for containment, but speed is not a promise of reversal. Contact the payment provider immediately through a known channel, explain that the payment was induced by a scam or was unauthorized, and ask what hold, recall, dispute, or account-protection process applies. In India, report suspected financial cyber fraud to 1930 and the National Cyber Crime Reporting Portal; the portal says its complaints are handled by law-enforcement agencies based on the information supplied. [1] [2]

If credentials were shared, change the affected password from a clean device and change any reused password. Review active sessions, recovery details, forwarding rules, new beneficiaries, UPI mandates, and unfamiliar devices where the service provides those controls. FTC post-scam guidance recommends changing compromised passwords and enabling two-factor authentication, while its payment guidance says to contact the company used to send money immediately and ask about reversal or refund options. [7] Those are general consumer steps; local banks, payment providers, and Indian authorities set the actual process.

• Tell the bank or payment provider the exact time, amount, channel, recipient identifier, and transaction reference; do not send a second payment to ‘unlock’ a refund.
• Secure email first when it controls password resets for other accounts, then review high-value accounts and remove unfamiliar sessions or recovery methods.
• If a device was given remote access, disconnect it from networks if safe, preserve relevant details, and use a trusted device to change credentials and contact providers.

Treat links, files, QR codes, and remote access as separate risks

A convincing message can lead to several different harms. A link may collect credentials, a file may install malware, a QR code may redirect payment, and a remote-support session may expose screens or stored data. Verification therefore includes checking the action itself. If the request asks you to disable a security feature, install an unrequested application, share a screen, open a macro-enabled file, or paste a command, stop and seek independent confirmation before doing anything.

CISA advises people not to click suspicious links or attachments, not to reply or use an unsubscribe link in a suspicious message, and to report and delete the message. It also notes that a suspicious message may imitate a trusted person or organization. [6] This guidance reduces exposure; it cannot prove that a message is malicious or make a clicked link harmless after the fact.

• Type a known address or use a trusted app instead of following a supplied link; inspect the destination only when doing so is safe and does not require a login.
• Never provide an OTP, PIN, password, recovery code, or private key to a caller who contacted you first.
• If a remote session occurred, treat displayed account information and copied files as potentially exposed until checked.

Report clearly and support the person affected

Reporting helps create a record even when the outcome is unknown. Use the relevant platform’s report function, the organization’s abuse or fraud route, the bank or payment provider, and the appropriate public authority. In India, the National Cyber Crime Reporting Portal says it accepts cybercrime complaints and provides status tracking; its page also distinguishes cybercrime reporting from emergencies and non-cyber crimes, for which it directs people to local police and other helplines. [1] [2]

A person who paid a scammer may feel ashamed, frightened, or pressured to hide what happened. Keep the conversation factual and time-sensitive. Help them preserve evidence, contact the payment provider, secure accounts, and report. Do not promise that a bank, police unit, platform, or helpline will recover funds, identify a suspect, or close a case by a particular date.

• Submit a concise timeline with exact identifiers and attachments that support the account; avoid speculation presented as fact.
• Ask a trusted person to sit with the affected individual during reporting if the caller demanded isolation or secrecy.
• Watch for a second scammer who claims to be a recovery agent, investigator, or official and asks for another payment.

Build a repeatable household or team control

A verification habit works better when it does not depend on memory during a stressful call. Agree on a pause phrase, a second-person check for unusual payments, approved contact methods for banks and services, and a rule that no one is punished for reporting a suspicious message. Keep recovery contacts and account-protection instructions somewhere that is not controlled by a single messaging account.

For teams, train people to report the original message and the observed action, not to investigate the sender on their own. Use phishing-resistant authentication where available, unique passwords, automatic updates, transaction alerts, and limits that reduce the consequence of one deceptive interaction. These controls do not make a person or organization immune; they make a single mistake easier to detect and contain.

• Create a written ‘pause, verify, report’ rule for urgent payment, identity, payroll, and account-recovery requests.
• Practice an India-specific escalation path: trusted colleague or relative, bank or provider, 1930, then cybercrime.gov.in, with local police for emergencies or non-cyber crimes. [1] [3]
• Review the process after a near miss and record what evidence was available, which channel was trusted, and what should change.

Evidence boundaries and limitations

The sources establish defensive guidance and reporting routes, not the identity or intent of any particular sender. A message can be suspicious without being proven fraudulent, and a legitimate organization can be impersonated through a compromised account or spoofed caller ID. No checklist can guarantee that a person will detect a well-crafted scam or avoid every loss.

The India-specific claims in this article are bounded by the I4C advisory, I4C portal material, the citizen reporting instructions, and the MHA PIB release reviewed on 2026-09-25. The 1930 and portal routes are official reporting channels in those records; availability, intake questions, investigation steps, and banking outcomes may change. The advisory’s statement about digital arrest is reproduced as an official warning, not expanded into a new legal interpretation.

• A report is not proof that a case will be accepted, investigated to completion, or result in recovery.
• CISA and FTC guidance is general consumer or organizational guidance from the United States; it does not replace Indian law, bank terms, or local police instructions.
• The published Indian PDF gives a 24-hour portal-completion instruction after a helpline acknowledgement; confirm the current workflow when reporting because procedures can be revised. [2]
• No claim is made here about scam prevalence, total losses, attacker nationality, or the outcome of any individual incident.
• Technical evidence collection can alter data or create privacy risk; suspected device compromise may require qualified incident-response support.

Decision checklist

• Pause: do not transfer money, reveal an OTP or PIN, click a link, open an attachment, or install software while the request is unverified.
• Preserve the original message, caller details, profile, URL, document, payment alert, timestamp, and transaction reference without forwarding risky files.
• Identify the claimed organization, then find its contact route independently through a known app, statement, card, or typed web address.
• Check the exact request through the independent route; do not ask the suspicious caller to prove their identity.
• Ask a trusted relative or colleague to review an urgent or secret payment request before any transfer.
• For an India digital-arrest claim, end the demanded video call, do not pay to settle a case, and do not share personal or financial information. [3]
• If money or payment credentials were sent in India, contact the bank or provider immediately, call 1930, and report at cybercrime.gov.in. [1] [2]
• If a 1930 acknowledgement or login ID is issued, follow the current portal instructions and retain the acknowledgement.
• If a password or account access was exposed, change it from a trusted device, remove unfamiliar sessions, and enable available multi-factor authentication. [7]
• Treat any later ‘recovery’ demand as unverified; never pay another fee because a caller promises guaranteed recovery.

Limitations

• This guidance cannot authenticate a specific sender or determine criminal liability from a message alone.
• Official reporting channels do not guarantee blocking, investigation, refund, arrest, or recovery.
• The India process and portal instructions may change after the reviewed source dates; confirm current instructions at the time of reporting.
• US CISA and FTC material is included for general defensive practice and is not Indian legal or banking advice.
• Evidence preservation must be balanced against privacy, device safety, and the risk of altering or spreading malicious content.

Evidence sources

1. National Cyber Crime Reporting Portal, Ministry of Home Affairs, Government of India — Filing a Complaint on National Cyber Crime Reporting Portal
2. Indian Cyber Crime Coordination Centre, Ministry of Home Affairs, Government of India — National Cybercrime Reporting Portal (NCRP)
3. Indian Cyber Crime Coordination Centre, Ministry of Home Affairs, Government of India — Advisory on 'Digital Arrest' based cybercrime in India
4. Press Information Bureau, Ministry of Home Affairs, Government of India — Alert against incidents of ‘Blackmail’ and ‘Digital Arrest’ by Cyber Criminals Impersonating State/UT Police, NCB, CBI, RBI and other Law Enforcement Agencies
5. Federal Trade Commission, United States Government — Scams
6. Cybersecurity and Infrastructure Security Agency, United States Government — Recognize and Report Phishing
7. Federal Trade Commission, United States Government — What To Do if You Were Scammed
8. Cybersecurity and Infrastructure Security Agency, United States Government — StopRansomware Guide