User Safety Guide – Protecting Your Money, Phone and Identity on P2P Token Apps

In a P2P setup, nobody stands between you and the other person. That is useful, because the money does not sit with a middleman, but it also means the checking job falls on you. A bank would normally reverse a suspicious transfer or hold it for review. Here, once you release tokens or hit confirm, the decision is usually final.

Three ideas make everything else easier to follow:

• Slow is safe. Every scam we describe below depends on you acting before you think. A trade that cannot survive five minutes of checking is not a trade worth making.
• Trust the system you opened yourself. Your own bank app, the app screen you navigated to yourself, and the domain you typed carefully are reliable. A link, a number or a screenshot somebody sent you is not.
• Assume you can be targeted. Fraudsters do not pick clever people or foolish people; they pick whoever answers. Being cautious is not an insult to the other person, it is routine.

Many apps in this category are shared as APK files instead of through the Play Store. That means Google has not checked the file for you, so the checking becomes your job.

Before you download

• Type the website address yourself or use a bookmark you made earlier. Do not tap download buttons inside ads, comments, YouTube descriptions or forwarded messages.
• Read the domain slowly. Swapped letters, an extra word, or a different ending such as .xyz or .top instead of the one you expect are the usual giveaways.
• Be wary of pages that rush you with countdown timers, "limited slots" banners or fake download counters.

While installing

• Allow "install unknown apps" only for the single browser or file manager you are using, and switch it off again afterwards.
• Keep Google Play Protect on. If it flags the file, stop and do not press "install anyway" out of habit.
• Look at the permissions requested. A trading app has little reason to need your contacts, call logs, SMS inbox, or screen-recording access. SMS access in particular lets malware read your bank OTPs.

After installing

• Check the app name and icon against what you saw on the verified source. Look-alike names with words like "Pro", "Plus", "New" or "Gold" deserve suspicion.
• Delete the downloaded APK file once installed so it does not get reshared or reinstalled by mistake.
• Never install a "modified", "unlimited" or "hack" version. These are the most common way for spyware to reach a phone.

An account takeover usually starts with something small, like a reused password or an OTP read out over a call. Here is how to close those doors.

• One password per app. If you reuse your email password here, a leak somewhere else becomes a leak here. A password manager or a long phrase that only you can recall works better than a short clever word.
• OTPs are for you alone. A one-time code exists to prove you are present. If someone asks you to read it out "to verify", "to cancel a payment" or "to receive a refund", they are using it to prove they are you.
• Your UPI PIN is only for sending money. You never need to type it to receive money. If a screen asks for your PIN while you expect to be paid, cancel immediately.
• Lock your phone properly. Use a screen lock that is not a simple pattern or birth date, and do not leave trading apps open on a shared or borrowed device.
• Keep your SIM safe. Your mobile number is the key to your account. If your phone suddenly loses network for no reason, contact your operator quickly, since SIM swap fraud begins that way.
• Use only your own details. Registering with someone else's number or bank account causes disputes and problems that are hard to fix later.

Payment fraud in P2P trades follows a small number of patterns. Having a fixed routine removes the need to judge each situation on the spot.

When you are the seller

1. Open your own bank or UPI app, not a link or image from the buyer.
2. Find the credit and confirm the amount is complete. A short payment of even a few rupees means the order is not settled.
3. Read the payer name and reference. If a third party paid, treat it as higher risk and raise it in the app before releasing anything.
4. Confirm the status says successful and not processing. Some banks show a pending credit that later fails.
5. Release only after all four checks, even if the buyer keeps messaging that they are "waiting".

When you are the buyer

• Pay only the account details shown for your specific order inside the app. A "new number, the old one is down" message in chat is a classic diversion.
• Copy the payment details instead of retyping them, then compare the receiver's name on the confirmation screen before entering your PIN.
• Keep your transaction ID and a screenshot of the success screen so you can support an appeal if the other side claims non-payment.

Request versus receive

A scam that catches careful people is the collect request. The "buyer" sends a request that looks like money is arriving, but approving it with your PIN sends money out. Read the wording on the approval screen. If it says pay, you are the one paying.

Odd payment situations

• Overpayment with a request to refund the difference. Return nothing until the original payment is confirmed as final in your account, and handle the matter through the app.
• Payment arriving in pieces from different people. This can indicate mule accounts. Pause the order and use the in-app dispute process.
• Buyer asks you to release first "because the bank is slow". Banks show successful credits immediately in nearly every case. Decline politely.

Any brand with visible popularity attracts copycats. They copy names, logos, photos of "team members" and even old posts. What they cannot easily copy is the way genuine channels behave.

• They contact you first. A private message after you join a group, offering "help", "VIP slots" or "account upgrade", is almost always a scam.
• They want you to move off the app. Disputes belong inside the app where records exist. A request to settle on a call, video chat or private chat is meant to remove the evidence.
• They ask for screen sharing. Remote-access apps let a stranger watch you enter PINs and read your OTPs. Never install one at someone else's request.
• They quote a support number from a web search. Numbers placed on search results and map listings are frequently planted by scammers.
• They promise recovery of lost money for a fee. This is a second scam aimed at people already burned. Recovery agents who charge upfront are not legitimate.
• They show screenshots of big earnings. Such images can be made in minutes. Treat them as advertising, not evidence.

When in doubt, close the chat, wait an hour and ask yourself what you would do if the person were a stranger on the street. That is what they are.

It is easy to forget that a P2P trade touches your real bank account. If money reaching you came from a fraud victim, the bank may place a hold on your account while investigators trace the funds, even when you did nothing wrong. This can freeze your salary, bills and savings together.

• Consider using a separate account for trading, with only the balance you can spare, rather than your main salary account.
• Prefer to trade with counterparties whose profile history is visible, and be cautious with brand-new profiles offering unusually generous rates.
• Never let anyone use your account to "receive and forward" money, whatever the commission. This is how people become money mules, which is a criminal offence with serious consequences.
• Keep records: order details, transaction IDs, chat logs and the time of each trade. If your bank or police ever ask, you can explain a trade quickly and clearly.
• If your account is frozen, contact your bank branch in writing and ask which agency issued the hold. Provide your trade records politely and follow up.

Taxes also deserve a thought. Gains from virtual digital assets are taxable under Indian rules, so maintain records through the year so that you are not hunting for them at filing time. A chartered accountant can explain what applies to you.

• Update your phone. Security patches close the holes that malware depends on. If your phone no longer receives updates, avoid keeping banking and trading apps on it.
• Review app permissions every few months. Revoke accessibility, overlay and notification access for apps that do not clearly need them.
• Avoid public Wi-Fi for payments. Mobile data is safer than an open network in a cafe or station.
• Turn off message previews on the lock screen. Visible OTPs can be read by anyone nearby.
• Do not click shortened links in SMS or chat that claim a KYC update, a refund or a blocked account. Open your bank app yourself instead.
• Use a basic antivirus or the built-in scan if you sideload apps, and uninstall anything you no longer use.

Understanding why scams work helps you notice them while they are happening. Almost every fraud pulls the same four levers.

• Urgency: "Pay in two minutes or the order cancels." Real orders have time windows, but fraudsters shrink them in chat to rush your thinking.
• Authority: A confident voice claiming to be support, police or a bank officer. Authority is easy to imitate and hard to check in the moment.
• Greed: Rates far better than anything else, bonuses for friends, or promises of daily income. If the offer sounds too good, someone else is paying for it.
• Fear: Threats of account blocking, legal action or lost funds. Calm, official processes do not start with panic.

A useful trick: say out loud what the other person is asking you to do. "A stranger wants me to read my OTP so my money will be safe." Hearing it often shows how strange it is.

Time matters more than anything here. Money that has just left an account is easier to hold than money that has moved through several accounts. Do not feel embarrassed; people from every background are caught.

1. Call 1930, India's national cyber crime helpline, right away and give the transaction details.
2. Inform your bank through its official helpline or branch and ask them to flag the transaction and, if needed, block your card or UPI access.
3. File a complaint at cybercrime.gov.in with transaction IDs, the other party's details, screenshots and chat logs.
4. Change passwords for the trading app, your email and any app that shares the same password, and remove unknown devices from your accounts.
5. Uninstall suspicious apps and run a security scan. If a remote-access app was installed, consider backing up important data and resetting the phone.
6. Report the incident inside the app using its dispute or support option, and keep a copy of your reference number.
7. Visit the local police station if the amount is large or if the cyber portal asks for an FIR, and keep copies of everything you submit.

Safety is partly about technology and partly about boundaries you set before emotions get involved.

• Decide a maximum amount you are willing to lose completely, and never go beyond it, even after a good week.
• Do not borrow money, use credit cards or take loans to trade. Debt turns a small mistake into a long-term problem.
• Start with a very small first order to understand the flow, and increase only after several clean trades.
• Avoid inviting friends and family unless you have shown them the risks first. Pulling relatives in with promises of earnings damages relationships when results disappoint.
• If trading begins to affect your sleep, work or mood, take a break. Talk to someone you trust, and if money stress feels overwhelming, a counsellor or a helpline can help.