Is this a scam? How to check a phone number, link, app, adviser or UPI ID in India

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Official tools can check most of what scammers send you: a caller, a website, an app, an adviser or a payee. Here is which check fits which situation, and what none of them can prove.

01 / Start here: what a check can and cannot tell you

Scammers change numbers, websites and UPI IDs faster than any list can keep up. That is why we do not publish our own list of scam numbers or websites. The official databases below are updated from real complaints, and someone is answerable for each one. The Indian Cybercrime Coordination Centre (I4C), for example, lets anyone who thinks they have been wrongly listed dispute the entry by email. A list kept by a news site offers neither.

No check can prove something is safe. A number that shows up nowhere may simply be new. Use these checks to catch known bad actors, and use the red flags in section 08 to catch new ones.

If you have already lost money, stop checking and call 1930 or file at cybercrime.gov.in. All the official tools are listed on our help page.

02 / Checking a phone number or caller

• Report it on Chakshu. The Department of Telecommunications' Chakshu service on Sanchar Saathi takes reports of suspected fraud calls, SMS and WhatsApp messages, such as fake KYC updates or impersonated officials. It asks for reports within 30 days. It is not for money already lost: for that, it sends you to 1930.
• Know which numbers banks use. TRAI requires entities regulated by RBI, SEBI, IRDAI and PFRDA to make service and transaction calls to existing customers from 1600xx numbers. Promotional calls from any sector must come from 140xx numbers. In November 2025 TRAI set deadlines for the switch, from 1 January 2026 for commercial banks to 15 March 2026 for qualified stockbrokers. Other SEBI-registered intermediaries can still move to 1600 voluntarily. If someone says they are calling from your bank on an ordinary 10-digit mobile number, treat that as a warning sign. Even on a 1600 number, never share an OTP or PIN.
• Don't trust the name on the screen. A caller's display name, a police logo on their profile picture or an official-looking number proves nothing.
• No agency arrests you over a video call. The Home Ministry warns that fraudsters pose as police, CBI, NCB or RBI officers and keep victims on video calls, sometimes in studios made up to look like police stations. The Prime Minister has said no government agency investigates through phone or video calls. See digital arrest scams.

03 / Checking a link or website

• Read the domain, not the page. RBI advises checking links in emails and SMS for spelling errors. A lookalike domain may add a word, swap a letter or use a different ending.
• Banks should be on .bank.in. In a circular dated 22 April 2025, RBI told banks to move their websites to the exclusive .bank.in domain by 31 October 2025. Only banks can register it, through the Institute for Development and Research in Banking Technology (IDRBT). If a site claiming to be an Indian bank sits on some other address, be suspicious.
• Don't trust search results for helplines. RBI warns that contact numbers found through search engines may be fraudulent. Get them from the bank's or company's official website or app instead. See fake customer care scams.
• When in doubt, type the address yourself or open the official app. Don't tap the link you were sent.
• Search I4C's list. The cybercrime portal has a suspect search for websites and apps.

04 / Checking an app

• Install apps only from the official app store, and check that the developer name matches the real company. RBI warns that an unknown app can secretly access your confidential data.
• Never install an APK file sent on WhatsApp or SMS, whatever it claims to be. See APK malware on WhatsApp.
• Loan apps: since 1 July 2025, RBI has published a directory of Digital Lending Apps that lets you check whether an app really is linked to an RBI-regulated lender. See loan app harassment.
• Trading apps: SEBI's investor support page links to the stock exchanges' lists of brokers' authorised mobile apps and official social media handles.

05 / Checking a person: adviser, company or official

• Stock tips or investment advice: check the person's registration on SEBI's intermediary search. Since 1 October 2025, SEBI-registered investor-facing intermediaries have been able to collect money through UPI IDs ending in @valid, with a suffix such as .brk for brokers or .mf for mutual funds. A thumbs-up inside a green triangle appears when you pay. SEBI says its absence is a caution that you may be paying an unauthorised entity. See investment and trading scams and how to check a stock market WhatsApp group.
• Deposit schemes or "guaranteed returns": RBI's Sachet portal lets you check whether an entity is registered with any regulator to accept public deposits, and lets you complain if one has collected money illegally.
• Companies and officials: hang up, then call back on a number from the official website or app. Never use the number the caller gives you.

06 / Checking a UPI ID or bank account before you pay

• Search it on I4C. The suspect search checks mobile numbers, email addresses, bank account numbers, UPI IDs and social media handles against cybercrime complaints. Read its disclaimer: "I4C does not certify the authenticity of complaints". It also warns that the database is incomplete, because criminals quickly create, change and dispose of identifiers.
• Check the name. RBI required banks to show the beneficiary's account name for NEFT and RTGS transfers by 1 April 2025. The name is fetched from the account number and IFSC. If it doesn't match the person or company you think you are paying, stop.
• Paying a SEBI-registered entity? SEBI Check verifies their bank account or @valid UPI ID.
• RBI's rule of thumb: you never need to scan a QR code or enter your PIN to receive money.

07 / Checking a job offer or task

The Home Ministry has described how task scams work. Ads for work-from-home jobs lead to a WhatsApp or Telegram chat. You are paid a small commission for liking videos or rating places on maps, then asked to put in money to earn more. Once you deposit a larger sum, it is frozen.

• A real employer does not ask you to pay to work or to unlock your earnings.
• Check the company's careers page on its official website. Don't rely on a recruiter's chat.
• The Home Ministry advises against doing tasks for unknown people who contact you on WhatsApp or Telegram.

See task and job scams.

08 / Red flags that apply to everything

• You are told to act now, keep it secret or stay on the call.
• You are asked for an OTP, UPI PIN, card details or remote access to your phone.
• Money has to go to a personal UPI ID or account instead of the organisation's own.
• Guaranteed or unusually high returns.
• A link, APK or QR code arrives from someone you didn't contact first.
• Threats of arrest, account blocking or legal action unless you pay.
• The contact details came from a search ad, a forward or the caller, not the official website.

If any of these apply, hang up, report it on Chakshu, and call 1930 if money has moved. Browse all scam types for more.