Fake Trading Apps and Phishing: A Safety Checklist for Every Retail Investor

Key Takeaways

1. Before using a trading app, verify the broker’s SEBI registration and confirm that the app is listed through an official exchange or SEBI investor-support resource.
2. Fake apps may be promoted through WhatsApp groups, Telegram channels and social media ads that promise fixed or unusually high returns.
3. Never share your OTP, password or PIN with anyone over a call, message or email, even if they claim to represent your broker, exchange or bank.
4. Pay only to the bank account or UPI ID of the registered broker and not to any personal account that has been shared with you on the chat.
5. In case of any such fraudulent activity, stop paying and report it to the National Helpline for Cybercrime at 1930 and report it through the official cybercrime portal.

An email pops into your inbox. You are invited to a "VIP stock tips" forum, and in no time a friend gives you a link to download a trading app that gives you huge profits right on the first day.

Everything looks genuine. But when you try to withdraw, the money does not come.

Fraudulent platforms and phishing messages can make it difficult to tell genuine online trading from a scam. This guide explains how fake apps and phishing scams work, the warning signs to watch for, and steps you can take to protect your money and demat account.

What Is a Fake Trading App?

A fake trading app is built to look like a genuine broker's platform but it is not an authentic app authorised by that broker. It may misuse the name, logo or registration details of a legitimate broker to appear genuine.

A fraudulent app may display made-up profits without carrying out genuine trades through a regulated broker. Money sent to fraudsters may not be invested as promised, and recovering it can be difficult. Do not assume that a profit shown on the app represents real holdings or money you can withdraw.

How Phishing Works in Online Trading

Phishing is an attempt to trick you into sharing private details such as your login ID, password, OTP or bank PIN.

In online trading, phishing usually comes through:

• SMS or email: A message says your account is "blocked," or your "KYC has expired" and asks you to click a link.
• Fake websites: The link opens a page that looks like your broker's login page but sits on a slightly different web address.
• Phone calls: A caller claims to be from your broker, exchange or bank and asks for an OTP to "verify" your account.
• Screen-sharing apps: You are asked to install a remote access app so the caller can "help" you, which gives them control of your phone.

If fraudsters obtain your login details or persuade you to grant remote access to your device, they may be able to access your account, attempt unauthorised transactions or misuse your personal information. Never install remote-access software at the request of an unverified caller.

Warning Signs to Watch For

Here's a simple way to compare a genuine platform with a fake one:

If you notice any warning sign, pause before downloading the app, sharing information or transferring money. Verify the details through official sources first.

The Safety Checklist for Every Retail Investor

1. Verify the broker on the SEBI website

Before signing up on a trading app, check the broker's registration through the SEBI website. Also verify that the app is an authentic app authorised by the broker using official broker, exchange or SEBI investor-support resources. Do not rely only on a registration number or logo shown in an advertisement or chat.

2. Download only from official app stores

Download the app through an official app store or the broker's verified website. Check the developer name and confirm the app through official broker or exchange resources. Avoid installing apps from links shared in chats or by unknown callers.

3. Never share your OTP, password or PIN

Never disclose your OTP, password or PIN to another person over a call, message or email. Be cautious of anyone who asks you to reveal these details or install software to give them access to your device.

4. Pay only to verified accounts

Transfer trading funds only to the verified bank account or payment handle of your registered broker. Before making a payment, use SEBI Check to verify the recipient's details. For UPI payments to registered intermediaries, check that the applicable validated UPI ID contains the @valid handle. Never transfer money to a personal account or UPI ID shared by an unknown person in a chat.

5. Ignore "guaranteed return" offers

Stock market investments involve risk. Be cautious of anyone promising fixed or guaranteed profits from stock trading, especially if they pressure you to deposit money quickly.

6. Check your statements regularly

Review your broker and depository alerts and contract notes. Report any trade that you did not initiate.

7. Turn on extra security

Use two-factor authentication and a strong, unique password for your trading app.

Common Doubts About Fake Apps and Phishing

Can a fake app show real stock prices?

Yes. Many fake apps show live prices to look genuine, but that does not mean your trades reach an exchange.

What if a group admin claims to be SEBI-registered?

Do not rely on a registration number or screenshot shared by the group admin. Verify the person or firm's details independently through SEBI's official resources. Be cautious if the group promises fixed returns or asks you to transfer money to a personal account.

Is it safe to click on links in broker emails?

Avoid clicking unexpected links, especially if a message creates urgency or asks you to verify your account. Open your trading app directly or type the broker's official website address into your browser. If in doubt, contact the broker through its verified support channels.

What should I do if I have already shared my OTP?

Change your password immediately, contact your broker to block access, and report the incident on the cybercrime helpline 1930 or at cybercrime.gov.in.

mastertrust is a SEBI-registered broker that offers a trading and demat account on mastertrust.co.in. You can download the official mastertrust trading app from authorised app stores and log in with secure authentication.

If you are new to online trading, you can read how to trade online using a trading and demat account, and what happens to your holdings in our demat account safety guide.

Final Thoughts

Fake apps and phishing scams work because they look convincing and move fast. Verifying the broker, downloading from official stores and never sharing your OTP can protect you.

Online trading involves financial risk, and fraud can occur even when a platform looks genuine. If you suspect a scam, contact your bank and broker through official channels and report suspected financial cyber fraud promptly.

Frequently Asked Questions (FAQ)

1. How can I check if a trading app is genuine?

Check the broker's SEBI registration through official SEBI resources. Then confirm that the app is authorised by the broker using its official website or relevant exchange and SEBI investor-support resources. Do not rely only on the app's name, logo or registration number.

2. Will a genuine broker ever ask for my OTP?

Never disclose your OTP, password or PIN to a person over a call, message or email, even if they claim to represent your broker, an exchange or a bank. If you receive an unexpected OTP, do not approve an action you did not initiate.

3. Where do I report a fake trading app?

You can report it on the national cybercrime helpline 1930 or at cybercrime.gov.in. You can also inform SEBI through its SCORES portal.

4. Can I recover money lost to a fake app?

Recovery is not guaranteed, but acting quickly may help the authorities and your bank take steps to address the fraud. Contact your bank immediately, call 1930, report the incident at the national cybercrime portal, and preserve transaction details and messages.

5. Is online trading safe?

Using an authentic trading app from a SEBI-registered broker helps you access the regulated securities market, but it does not remove investment risk or every security risk. Verify the platform, protect your login details and understand the risks before placing trades.

6. How do I know a payment is going to masterTrust?

Use the official mastertrust website or its authorised app to access payment instructions. Before transferring funds, verify the beneficiary details through official mastertrust channels and use SEBI Check to verify the recipient's payment details where applicable. Never transfer money to a personal account or UPI ID shared by an unknown person in a chat.