Your demat account holds your shares, ETFs, bonds and other securities, making it important to keep it secure. Scammers may use fake apps, impersonation, OTP or TPIN requests, and other tricks to gain access or authorise unauthorised transactions.
This guide explains the common demat account fraud risks in 2026 and the simple steps you can take to protect your account.
Demat account fraud happens when someone gains unauthorised access to your demat or trading account, personal information, or transaction authorisation and uses it to carry out transactions without your permission.
Fraudsters may try to steal your login details, OTP, PIN or TPIN, or convince you to approve a transaction yourself.
The good news is that many of these scams can be avoided by following a few basic security practices.
Before learning how to protect your demat account, it helps to understand how fraudsters usually target investors.
Fraudsters may create websites or mobile apps that look similar to genuine broker platforms. They may use familiar logos, names and investment-related messages to make the platform appear genuine.
They may then ask you to enter your:
Always download your broker’s app from an official app store and access the website by entering the official address yourself.
A scammer may pretend to be a broker’s customer support executive and contact you about account verification, refunds, KYC updates or technical problems. They may ask you to install a screen-sharing application or share an OTP.
A genuine support representative should not ask for your password, OTP, PIN or other confidential authentication details.
An OTP or TPIN is used to authorise certain actions. Fraudsters may call or message you pretending to help with a transaction and ask you to share the code.
Never share your OTP, TPIN, trading PIN or password with anyone.
If you receive a code for a transaction you did not initiate, do not approve or share it.
A phishing message may claim that your account will be blocked unless you complete KYC, update PAN details or verify your bank account. The message may contain a link that takes you to a fake website.
Do not open links received through unknown SMS messages, emails or social media accounts. Instead, open your broker’s official app or website directly.
Some scammers promise guaranteed returns, exclusive trading calls or access to a special investment account. They may ask you to transfer money to a personal bank account or install an unknown trading application. Be especially careful with anyone promising guaranteed returns from the stock market.
Fraud does not always mean that someone has completely taken over your account. An unauthorised transaction could involve:
Regularly checking your holdings and transaction statements can help you spot such activity early.
Use your broker’s official website and mobile application for trading and account-related activities. Avoid logging in through links received in unsolicited messages. Before entering your credentials, check the website address carefully.
Your OTP, password, trading PIN and TPIN are confidential. No legitimate person should need these details to “verify” your account or process a refund. If someone asks for them over a call, WhatsApp, email or social media, treat it as a warning sign.
Use two-factor authentication wherever your broker provides it. This adds another layer of security beyond your password.
Even if someone obtains your password, an additional authentication step can make it harder for them to access your account.
Your registered mobile number and email address are important for receiving transaction alerts and authentication messages. Keep them secure and make sure you receive alerts for account activity.
If you notice an unexpected change to your registered contact details, contact your broker immediately.
Don’t wait until tax filing or portfolio review to check your holdings. Review your demat account periodically and look for:
You can also check your demat holdings through your broker, CDSL, NSDL or your Consolidated Account Statement (CAS).
For a step-by-step guide, read How to Check Demat Account Balance Online.
A Power of Attorney (POA) allows another party to act on your behalf for specified activities. DDPI (Demat Debit and Pledge Instruction) is another mechanism that can authorise certain demat-related actions.
Read the permissions carefully before accepting them. Do not sign or approve a document simply because someone tells you it is required. Only provide the permissions you understand and actually need.
A person pretending to be customer support may ask you to install an application that lets them view or control your phone or computer.
Do not give unknown people remote access to your device. Your broker does not need unrestricted access to your device to help with a normal account-related query.
Avoid logging into your trading or demat account from shared computers or unknown devices. If you have to use another device, make sure you log out completely and do not save your password.
Install security updates for your operating system and trading applications. Use a screen lock on your phone and avoid installing applications from unknown sources.
Before transferring funds for trading or investing, check the beneficiary details carefully. Do not transfer money to a personal bank account because someone claims to be your broker, relationship manager or investment adviser.
Use the payment methods and bank details provided through your broker’s official platform.
TPIN, or Transaction Personal Identification Number, is used to authenticate certain transactions involving your demat holdings.
For example, when you sell securities from your demat account, you may need to authorise the debit of those securities.
Treat your TPIN like a password.
Do not share it with:
If you receive a TPIN-related request that you did not initiate, stop and verify the transaction through your official broker platform.
POA and DDPI are not automatic signs of fraud. They are mechanisms used to authorise certain transactions or instructions.
The important point is to understand what you are authorising.
Before accepting any POA or DDPI:
Act quickly if you see an unfamiliar transaction, security transfer, or account change.
Step 1: Contact Your Broker Immediately:
Contact your broker through its official customer support channel. Do not use a phone number or link sent by the suspected fraudster.
Step 2: Secure Your Account:
Change your password and other relevant security credentials. If necessary, ask your broker to temporarily restrict or freeze the affected account or services.
Step 3: Check Your Holdings and Transactions:
Review your recent orders, holdings, fund transfers, and demat transaction statements to understand what happened.
Step 4: Report Financial Cyber Fraud:
If money has been lost or you suspect financial cyber fraud, report it immediately through the 1930 cybercrime helpline or the National Cyber Crime Reporting Portal. The faster you report a fraudulent transaction, the better the chances of taking timely action.
For better information, read How to File a Complaint Against Your Demat Broker.
Step 5: Keep the Evidence:
Save:
These details can help when reporting the incident.
Protecting your demat account starts with a few simple habits: use only official apps and websites, never share your OTP, TPIN or PIN, verify payment and account requests, and regularly check your statements.
Be careful with POA/DDPI permissions and never give anyone access to your account. If you notice an unauthorised transaction, report it immediately through the appropriate channels, including 1930 or the National Cyber Crime Reporting Portal.
Verify first, authorise only what you understand, and act quickly when something looks wrong.
Attention Investors!
Stock Brokers can accept securities as margin from clients only by way of pledge in the depository system w.e.f. September 1, 2020. Update your mobile number & email Id with your stock broker/depository participant and receive OTP directly from the depository on your email id and/or mobile number to create a pledge. Pay 20% upfront margin of the transaction early to trade in the cash market segment. Investors may please refer to the Exchange’s Frequently Asked Questions (FAQs) issued vide circular reference NSE/INSP/45191 dated July 31, 2020, and NSE/INSP/45534 dated August 31, 2020, and other guidelines issued from time to time in this regard. Check your Securities /MF/ Bonds in the consolidated account statement issued by NSDL/CDSL every month.
Corporate Office: No. 153/2, 3rd Floor, M.R.B.Arcade, Bagalur Main Road, Dwaraka Nagar, Yelahanka, Bengaluru – 560 063, Karnataka.
Registered Office: Old No.56/2 ,New No.58, LIC Nagar, Vinayagar Kovil Street, Erode -8,Tamil Nadu– 638002.
Alice Blue Financial Services (P) Ltd : NSE EQ | NSE FO | NSE CDS-90112 SEBI REG : INZ000156038
Alice Blue Financial Services (P) Ltd : BSE EQ | BSE FO | BSE CD-6670 SEBI REG : INZ000156038
Alice Blue Financial Services (P) Ltd : CDSL DP ID 12085300 DP SEBI REG : IN-DP-364-2018
Alice Blue Financial Services (P) Ltd : MCX-56710 SEBI REG : INZ000156038
We hereby declare that we are doing PRO trading
Procedure to file a complaint on SEBI SCORES : Register on SEBI SCORES 2.0. Mandatory details for filing complaints on SCORES: Name, PAN, Address, Mobile Number, E-mail ID. Benefits: Effective Communication, Speedy redressal of the grievances
Click on the provided link to learn about the process for submitting a complaint on the ODR platform for resolving investor grievances.
Investment in securities markets are subject to market risks, read all the related documents carefully before investing. Brokerage will not exceed SEBI prescribed limit.
For queries regarding account opening or activation, email to [email protected] and for fund updates, email to [email protected]
Disclaimer : Prevent unauthorized transactions in your account. Update your mobile numbers/email IDs with your stock brokers. Receive information of your transactions directly from Exchange on your mobile/email at the end of the day. Issued in the interest of investors. All clients have to update their email id and mobile number with Member : Investor Grievance [email protected]
KYC is a one time exercise while dealing in securities markets – once KYC is done through a SEBI registered intermediary (broker, DP, Mutual Fund etc.), you need not undergo the same process again when you approach another intermediary.
No need to issue cheques by investors while subscribing to an IPO. Just write the bank account number and sign in the application form to authorise your bank to make payment in case of allotment. No worries for refund as the money remains in the investor’s account.
Investors are requested to note that Alice Blue Financial Services Private Limited is permitted to receive money from investor through designated bank accounts only named as Up streaming Client Nodal Bank Account (USCNBA). Alice Blue Financial Services Private Limited is also required to disclose these USCNB accounts to Stock Exchange. Hence, you are requested to use following USCNB accounts only for the purpose of dealings in your trading account with us. The details of these USCNB accounts are also displayed by Stock Exchanges on their website under “Know/ Locate your Stock Broker. Bank Details (Valid UPI FAQ).
