The Personal Cyber Safety Checklist for Indians

Most people who lose money online had a phone with no screen lock, a UPI app with the default ₹1 lakh limit, a WhatsApp with no two-step code and a Google account that was last checked when the phone was bought. This cyber safety checklist fixes all of that in about fifteen minutes. Do it now, on the phone in your hand, then do it on your parents' phones.

Each item below says what to change, where the setting lives, and why. Where an app's menu may differ by version, we say "under Settings, look for" rather than guessing. Items are ordered by how much loss they prevent, so if you stop halfway you have still done the important part.

The 15-minute cyber safety checklist

1. Screen lock and auto-lock (1 minute)

A lost phone with no lock is every account at once. Under Settings, look for Security or Lock screen. Choose a PIN of six digits, not a pattern, and add fingerprint or face for convenience. Set the auto-lock timer to 30 seconds or one minute. Turn on the "find my device" feature while you are there: Google's Find Hub on Android, Find My on iPhone. If the phone is stolen, block the IMEI on CEIR the same day.

2. UPI transaction limit (2 minutes)

UPI allows up to ₹1 lakh a day on most accounts, which is exactly what a digital arrest or task scam drains. Under Settings in your UPI app, look for a transaction, payment or spending limit. Many bank apps also let you set a daily UPI cap on the account itself. Set it to a figure you can live with; raise it for a day when you need to. The stronger version is a separate account that holds only a week's spending, which our UPI setup guide explains.

3. WhatsApp two-step verification (1 minute)

WhatsApp → Settings → Account → Two-step verification → Turn on. Choose a six-digit PIN you do not use elsewhere and add an email address for recovery. This PIN is what stops someone who has tricked you into reading out a six-digit SMS code from taking over your WhatsApp. Then Settings → Privacy → Calls → Silence unknown callers; it removes the most common entry point for sextortion video calls. The full set of settings is in how to secure WhatsApp.

4. Google or Apple security checkup (3 minutes)

On Android, open myaccount.google.com/security-checkup. It lists every device signed in, recent security events, third-party apps with access and whether 2-step verification is on. Sign out of anything you do not recognise, add a recovery phone and email, and turn on 2-step verification with an authenticator app or passkey rather than SMS alone. On iPhone, Settings → your name → Sign-In & Security does the same job. Gmail is the account that resets every other password, so this step protects all of them; see the Gmail guide for the details.

5. SIM PIN and TAFCOP (2 minutes)

A SIM PIN means a SIM moved to another phone asks for a code before it works. Under Settings, look for SIM lock or SIM card lock; the default PIN is printed on the SIM pack or available from your operator. Then open sancharsaathi.gov.in, choose TAFCOP, and check which connections are registered in your name. Unknown numbers are used for fraud calls and mule accounts; mark them for disconnection. SIM swap, where a duplicate SIM is issued to a fraudster, is explained in this guide; your only warning is the phone losing signal, so take that seriously.

6. Password manager (3 minutes to start)

You do not need to fix every password today. Install the manager built into your phone (Google Password Manager or Apple Passwords) or a free one such as Bitwarden, and change three passwords: email, net banking and the UPI app's login. Each should be long and used nowhere else. The manager will autofill on the real site and refuse on a lookalike, which is a phishing defence on its own. Our password manager guide covers the rest, including two-factor options.

7. App permissions (2 minutes)

Under Settings → Apps, open the permission manager and look at two lists: SMS and Accessibility. Banking apps and your messaging app may need SMS; a "courier tracking" or "PDF reader" app does not. Accessibility access lets an app read your screen and tap for you, which is how screen-sharing fraud works. Remove anything you cannot explain. Then check the list of installed apps for anything you do not remember installing, especially APK files that did not come from the store.

8. Unknown callers and spam filters (1 minute)

Beyond WhatsApp, the phone's own dialler has a spam and scam filter under Settings in the Phone app. Turn it on. It will not catch every fraud call, but it reduces the volume, and fewer calls means fewer chances to be caught tired. Report fraud calls and messages on Chakshu through Sanchar Saathi; here is how.

9. Aadhaar biometric lock (2 minutes)

On uidai.gov.in or the mAadhaar app, lock your biometrics so a fingerprint cannot be used for authentication without your unlocking it first. Download a masked Aadhaar for every copy you hand over; it hides the first eight digits. Check the authentication history every few months for use you do not recognise.

The rules that no setting can replace

Settings reduce how much can be taken. Rules reduce whether anything is taken at all. Agree these at home, out loud.

The safe word is the cheapest defence against voice cloning. Choose something a stranger could not guess from social media, tell the family, and use it. The voice-clone scam depends on panic and speed; one odd question breaks both.

Repeat every six months

Phones get replaced, apps update, permissions creep back. Put a reminder in the calendar for six months from today and run the list again: remove old devices from the Google account, re-check TAFCOP, confirm the UPI limit is still what you set, and update the manager with any new passwords. After a phone change, do the whole list on day one; a new phone restores apps but not always their security settings. Before a trip, add the travel items in our public Wi-Fi and travel guide.

If something has already gone wrong, settings come second: call 1930, file on cybercrime.gov.in, and write to the bank today. If you would rather have someone go through the phone with you, our device and privacy audit does exactly this list, plus the things that are specific to your apps and accounts, and leaves you with a written record of what was changed.