A Demat account holds your shares, bonds, ETFs and other securities in electronic form. Because it is connected to your trading account and personal financial information, criminals may try to gain access through phishing, fake trading platforms, social engineering, fraudulent investment offers or misuse of account credentials.
Demat account fraud can involve unauthorised trades, securities transfers, account takeover, fake investment schemes or theft of login information.
SEBI and the depositories regularly warn investors about scams involving fake trading apps, social-media investment groups, phishing links, account-handling services and requests for sensitive information.
Knowing the common scams and warning signs can help investors protect their Demat and trading accounts.
What Is Demat Account Fraud?
Demat account fraud occurs when someone misuses your Demat or linked trading account, credentials, securities or personal information without your proper authorisation.
It can take different forms, such as:
- Unauthorised buying or selling of securities
- Unauthorised transfer of shares
- Theft or misuse of login credentials
- Fake trading applications
- Phishing websites and messages
- Fraudulent stock tips and investment schemes
- Misuse of blank Delivery Instruction Slips (DIS)
- Fraudulent requests for OTPs or passwords
- Fake customer-care or broker representatives
- Fraudulent account-handling services
Not every unexpected Demat transaction is necessarily fraud. A bonus issue, stock split, merger, rights issue or another corporate action can also change your holdings. The transaction statement should therefore be checked before drawing a conclusion.
Common Demat Account Scams
- Fake Trading App Scam
In this scam, fraudsters promote a fake trading application through WhatsApp, Telegram, social media, advertisements or direct messages.
The scam may follow this pattern:
- You are added to an investment group.
- Someone presents themselves as a market expert.
- They show apparently successful trades or high returns.
- You are asked to download a trading app.
- The fake app displays profits.
- You are encouraged to deposit more money.
- When you try to withdraw, the platform demands additional fees or stops responding.
SEBI’s investor education material specifically warns about fake trading apps that use social-media groups, fake profits and withdrawal restrictions to deceive investors.
- Phishing Links
A fraudster may send an SMS, email or message claiming to be from your broker, bank, depository or another financial institution.
The message may say:
- Your account will be blocked
- KYC needs to be updated
- Your Demat account has been frozen
- You need to verify your PAN
- Your account has suspicious activity
- You must click a link to prevent account closure
The link may lead to a fake login page designed to capture your username, password or other information.
NSDL advises investors not to click suspicious links received through SMS, email or social-media platforms and not to share passwords, OTPs, CVVs or PINs.
- OTP and Password Scam
Someone may call pretending to be a broker employee, bank representative or customer-support agent.
They may ask for:
- OTP
- Trading password
- Demat password
- PIN
- CVV
- Login credentials
The reason may sound genuine, such as account verification or KYC updating.
However, SEBI’s investor charter specifically says investors should not share passwords or OTPs and should not share login credentials for depository facilities.
- Fake Customer-Care Scam
Fraudsters can use search engines or social media to present themselves as customer-support representatives.
For example, an investor searching for a broker’s helpline may accidentally contact a fake number and be asked to install remote-access software or share account credentials.
Always verify customer-care details through the broker’s official website or app rather than relying on numbers received through unsolicited messages.
- Fake Stock Tips and Investment Groups
WhatsApp and Telegram groups can be used to promote supposedly exclusive stock tips.
Scammers may display:
- Fake profit screenshots
- Fake expert profiles
- Fake testimonials
- Claims of guaranteed returns
- Urgent “buy now” messages
- Promises of insider information
SEBI advises investors to be cautious of unsolicited investment advice, guaranteed returns and unregistered entities.
- Account-Handling Scam
A newer scam involves people offering to handle an investor’s trading or investment account in exchange for promised profits or returns.
SEBI issued a specific caution on February 26, 2026, regarding stock-market scams involving account-handling services. Investors should be particularly careful before giving another person control or access to their investment account.
Giving someone access to your account can create risks involving unauthorised transactions, misuse of credentials and loss of control over your investments.
- Blank DIS Fraud
A Delivery Instruction Slip (DIS) can be used to give instructions for transferring securities.
SEBI’s investor charter advises investors to obtain the DIS book only from their DP, keep it safely, and never sign or issue a blank or partially completed DIS. The investor charter compares a blank signed DIS to a bearer cheque because of the risk of misuse.
Never sign a blank DIS merely because someone says it is required for account activation or verification.
- Fake KYC or Account-Freeze Scam
Fraudsters may claim that your Demat account will be frozen unless you immediately update your KYC.
They may send a link asking for:
- PAN
- Aadhaar details
- Bank information
- Login credentials
- OTP
- Other personal information
If you receive such a message, do not click the link. Open the official broker or DP website/app independently and check whether any action is actually required.
Warning Signs of a Demat Scam
Watch for these red flags:
| Warning Sign | Why It Is Suspicious |
| Guaranteed stock-market returns | Securities investments carry risk |
| Urgent request for money | Pressure can prevent proper verification |
| Unknown APK/app link | May contain malicious software |
| Request for OTP | OTP should remain private |
| Request for password | Genuine support should not need your password |
| Payment to a personal account | Payment destination may not belong to the registered intermediary |
| WhatsApp/Telegram-only support | Identity may be difficult to verify |
| Fake profit screenshots | Screenshots can be fabricated |
| Withdrawal blocked with new fees | Common feature of fake trading-app scams |
| Someone wants control of your account | Creates significant security risk |
SEBI’s scam-awareness guidance identifies guaranteed returns, unregistered entities, pressure tactics and unsolicited offers as important warning signs.
How to Protect Your Demat Account
- Never Share Your Password
Your Demat and trading passwords should remain private.
Do not share them with:
- Friends
- Relatives
- Brokers’ representatives
- “Investment managers”
- Customer-support callers
- Social-media contacts
SEBI’s investor guidance specifically recommends never sharing investment-account passwords.
- Never Share OTPs
An OTP is intended to authenticate a transaction or login.
Do not read an OTP aloud to someone over the phone or forward it through WhatsApp, SMS or email.
- Use Official Apps and Websites
Download trading applications only through legitimate app stores and verify the broker’s official website.
SEBI specifically warns investors about unverified apps and APK files in its fake trading-app scam guidance.
- Check Your Demat Transactions Regularly
Do not wait until the end of the year to check your account.
Review:
- Holdings
- Transaction statement
- Securities debits
- Securities credits
- Transfers
- Pledge entries
- Broker trades
SEBI’s investor charter advises investors to carefully verify all debits and credits and report an unauthorised transaction to the DP or respective depository.
- Enable Alerts
Keep your mobile number and email address updated with your broker and DP.
SEBI says investors can receive SMS and email alerts for trading and Demat-account activity and should keep their contact details updated.
- Be Careful With POA and Account Access
Before granting a Power of Attorney (POA) or other authority relating to your Demat account, understand exactly what powers are being given.
SEBI advises investors to carefully examine the scope and implications of powers granted to intermediaries.
Do not give account credentials to an individual simply because they promise to manage your investments.
- Keep Your DIS Book Safe
If you have a physical DIS book:
- Keep it securely
- Never sign blank slips
- Fill in the ISIN correctly
- Enter the exact quantity
- Do not hand over unused slips
- Keep track of issued slips
These precautions are specifically included in the SEBI investor charter.
What to Do If You Suspect Demat Fraud?
Act quickly if you notice an unauthorised transaction.
Step 1: Check the Transaction
Download your latest Demat transaction statement and identify:
- Date
- Security
- ISIN
- Quantity
- Debit/credit
- Transaction description
- Reference number
Step 2: Contact Your Broker and DP
If the issue involves a trade, contact the broker.
If it involves your Demat holdings or a securities transfer, contact your DP as well.
Ask for the transaction details and raise a written complaint.
Step 3: Secure Your Accounts
If you suspect that your login credentials have been compromised:
- Change your passwords
- Log out of other sessions where the facility permits
- Contact your broker
- Review recent trades
- Review Demat transactions
- Do not approve unexpected OTP requests
Step 4: Report the Cyber Fraud
If money or securities have been lost through a suspected cyber fraud, report it promptly to the appropriate cybercrime authorities.
SEBI’s investor material identifies 1930, the national cybercrime helpline, and the government cybercrime reporting system as channels for reporting cyber fraud.
Step 5: Escalate the Securities-Market Complaint
If your complaint with the broker or DP is not resolved, you can escalate it through the applicable depository grievance mechanism and, where appropriate, SEBI SCORES.
SEBI advises investors to first approach the concerned intermediary and then use SCORES if the grievance remains unresolved.
Broker vs DP: Whom Should You Contact?
| Problem | First Point of Contact |
| Unauthorised trade | Broker |
| Wrong Demat debit | DP and broker, as applicable |
| Unknown securities transfer | DP |
| Login/account compromise | Broker/DP immediately |
| Fake investment scheme | Cybercrime authorities and relevant regulator, as applicable |
| Corporate-action discrepancy | DP/company or relevant intermediary |
| Unresolved DP complaint | Depository |
| Unresolved eligible intermediary complaint | SEBI SCORES |
If you are unsure which organisation is responsible, report the issue to your broker and DP and keep a written record of both complaints.
What Not to Do After a Scam
Avoid these mistakes:
- Do not send more money to recover supposed profits.
- Do not pay an unknown person claiming to be a “recovery agent.”
- Do not share another OTP.
- Do not delete scam messages or transaction records.
- Do not install remote-access software at an unknown caller’s request.
- Do not continue communicating through an unverified WhatsApp or Telegram account.
- Do not assume a small unauthorised transaction is harmless.
Scammers may sometimes ask victims to pay additional taxes, withdrawal fees or processing charges before releasing supposed profits. SEBI specifically describes withdrawal blocks and additional-fee demands as part of fake trading-app scams.
Simple Demat Account Safety Checklist
Use this checklist regularly:
- Use a SEBI-registered DP.
- Keep your Demat and trading passwords private.
- Never share OTPs, PINs or CVVs.
- Use official broker/depository apps and websites.
- Avoid unknown APK files and links.
- Check Demat transactions regularly.
- Keep SMS and email alerts active.
- Keep your registered mobile number and email updated.
- Never sign a blank DIS.
- Be cautious of guaranteed-return offers.
- Verify investment advisers and intermediaries.
- Do not give account control to unknown persons.
- Report suspicious transactions quickly.
Frequently Asked Questions
Can someone withdraw shares from my Demat account?
Securities can be transferred from a Demat account through permitted mechanisms and instructions. If you see an unauthorised debit or transfer, contact your DP and broker immediately and ask them to investigate.
Can a broker ask for my Demat password?
You should not share your Demat or trading password with anyone. SEBI’s investor guidance specifically says not to share these credentials.
Is a WhatsApp stock-tip group always a scam?
Not every group can be categorised solely because it uses WhatsApp, but unsolicited groups promising guaranteed or unusually high returns are a significant warning sign. Verify the person and intermediary independently before acting.
What should I do if I clicked a suspicious trading link?
Do not enter further credentials or OTPs. If you entered your password or other sensitive information, change the affected credentials through the official platform and contact your broker or DP immediately. If financial fraud has occurred, report it promptly through the appropriate cybercrime channel.
How can I know whether a trading app is genuine?
Verify the broker or intermediary through official regulatory or exchange resources and download apps only through trusted official channels. SEBI specifically advises investors to verify platform legitimacy and avoid unverified app links or APK files.
Conclusion
Demat account fraud can take many forms, from phishing links and fake trading apps to unauthorised transactions, fake investment groups and account-handling scams. The most important protection is to keep control of your account credentials and verify every unexpected transaction.
Never share your password or OTP, avoid unverified investment platforms, check your Demat statement regularly and be cautious about anyone promising guaranteed returns. If you notice an unauthorised transaction, contact your broker and DP immediately and preserve all evidence. For suspected cyber fraud involving financial loss, prompt reporting through the appropriate cybercrime channels can also be important.