A Demat account contains your electronic securities, so protecting it from hacking and unauthorised access is important. A compromised account can potentially expose your personal information and may lead to unauthorised trading, securities transfers or other account activity.
However, Demat account security is not only about choosing a strong password. Investors should also protect their trading account, registered email address and mobile number, because these can be connected to the authentication and recovery process.
SEBI’s investor guidance advises investors not to share passwords or OTPs, to verify transaction statements carefully and to report unauthorised debits or credits to the DP or relevant depository.
Use a Strong and Unique Password
Your trading and Demat-related login credentials should not be easy to guess.
Avoid passwords based on:
- Your name
- Date of birth
- Mobile number
- PAN
- Family members’ names
- Simple number sequences
- Passwords already used on other websites
Ideally, use a long, unique password or passphrase that you do not use anywhere else.
If your broker provides additional authentication options, use them.
Enable Multi-Factor Authentication
Multi-factor authentication (MFA) provides an additional security layer beyond the password.
For example, logging in may require:
Password + OTP
or another approved authentication factor.
SEBI’s cybersecurity framework for regulated entities provides for strong authentication controls, including multi-factor authentication in relevant systems.
CDSL has also implemented multi-factor authentication for its investor-facing services, including OTP-based authentication using registered contact details.
If MFA is available for your broker, Demat or related investment services, it is generally worth enabling.
Never Share Your OTP
An OTP should remain private.
Someone may call and claim to be:
- Your broker’s employee
- A bank representative
- A depository representative
- Customer support
- A KYC agent
- An investment adviser
They may ask you to tell them the OTP to “verify” your account.
Do not share it.
CDSL’s investor guidance specifically warns investors not to share or forward OTPs related to Demat transactions.
Never Share Your Login Credentials
Do not give your trading or Demat-related login details to another person.
This includes:
- Username
- Password
- TPIN
- PIN
- OTP
- Security answers
- E-DIS credentials
SEBI’s investor guidance specifically advises investors not to share login credentials for depository internet facilities such as e-DIS and other depository services.
Even if someone claims they can make profitable trades on your behalf, giving them your login credentials creates a significant security risk.
Beware of Phishing Links
Phishing is one of the simplest ways criminals can steal account credentials.
You may receive a message saying:
“Your Demat account will be blocked. Update your KYC immediately.”
The message may contain a link to a fake website that looks similar to your broker or depository’s website.
Other common messages include:
- KYC expiry warnings
- PAN verification requests
- Account-freezing warnings
- Suspicious-login alerts
- Bonus or IPO offers
- “Refund” messages
- Trading-account activation notices
Do not log in through an unexpected link.
Instead, open your broker’s official app or manually enter its verified website address.
Download Trading Apps Carefully
Fake trading applications can be used to steal credentials or manipulate investors into transferring money.
Be especially careful with:
- APK files sent through WhatsApp
- Telegram links
- Unknown websites
- Links from social-media accounts
- Apps promoted by unknown investment groups
A legitimate-looking app name or logo does not by itself prove that an application is genuine.
Download your broker’s application through an official app store and verify the developer information.
Protect Your Registered Email Account
Your email account can be an important part of your investment-account security.
If someone gains access to your email, they may potentially see:
- Broker communications
- Transaction notifications
- Account information
- Password-reset messages
- Statements
- Investment-related documents
Therefore:
- Use a strong, unique email password.
- Enable MFA on your email account.
- Do not share email login credentials.
- Check for unfamiliar login sessions.
- Keep recovery information updated.
Protecting your email account is therefore part of protecting your Demat account.
Keep Your Mobile Number Updated
Your registered mobile number may be used for OTPs and transaction alerts.
If you change your mobile number, update it with the relevant broker, DP and other financial institutions.
CDSL advises investors to keep their mobile number updated and to use transaction alerts to monitor Demat activity.
Do not ignore unexpected OTPs or Demat transaction alerts.
Monitor Every Demat Transaction
One of the simplest security measures is regularly checking your account.
Review:
- Holdings
- Transaction statements
- Securities debits
- Securities credits
- Off-market transfers
- Pledge entries
- Trading activity
- Corporate-action entries
SEBI’s investor guidance specifically advises investors to carefully verify all debits and credits in the transaction statement and report unauthorised activity to the DP or relevant depository.
If you notice a transaction that you do not recognise, investigate it immediately.
Keep SMS and Email Alerts Active
Transaction alerts can help you identify suspicious activity quickly.
For example, suppose you receive an alert saying that 200 shares have been debited from your Demat account.
If you did not sell or transfer those shares, you can immediately check your account and contact your DP.
CDSL’s investor material recommends transaction alerts and specifically tells investors not to ignore alerts for unauthorised debits.
Do Not Use Public Wi-Fi for Trading
Avoid logging into your trading or Demat-related accounts on unsecured public Wi-Fi networks.
For example, be cautious when accessing financial accounts from:
- Public cafés
- Airports
- Hotels
- Railway stations
- Shared computers
- Untrusted networks
Prefer your own trusted network or mobile data connection.
Also avoid saving your trading password in browsers on shared computers.
Keep Your Phone and Computer Updated
Security updates can fix vulnerabilities in your operating system, browser and applications.
Regularly update:
- Smartphone operating system
- Computer operating system
- Browser
- Broker application
- Security software
Also use a screen lock on your phone and computer so another person cannot easily access your financial applications.
Do Not Install Remote-Access Apps for Unknown Callers
A fraudster may claim that they need to “check your account” and ask you to install a remote-access application.
This can potentially allow another person to see or control your device.
Never install remote-access software merely because an unknown caller claims to be from your broker, bank or depository.
If you need customer support, contact the organisation through its verified official channel.
Be Careful With Screen Sharing
Screen-sharing requests can expose:
- Account numbers
- Login screens
- OTPs
- Transaction details
- Personal information
Do not share your screen with an unknown person while logging into your trading or Demat account.
Even if the caller says they only want to “guide” you through a process, it is safer to complete sensitive steps privately.
Be Careful With Power of Attorney and Account Authorisations
Investors should understand exactly what authority they are giving when signing a Power of Attorney (POA) or another account-related authorisation.
Do not sign blank forms or give broader authority than necessary.
Similarly, do not allow an unknown person to operate your account simply because they promise to manage your investments or generate returns.
Keep Your DIS Book Secure
If you use physical Delivery Instruction Slips (DIS), treat them as sensitive documents.
Do not:
- Sign blank DIS forms
- Leave completed slips unattended
- Give unused slips to unknown people
- Share photographs of signed slips unnecessarily
SEBI’s investor guidance specifically advises investors to keep records of DIS issued and avoid signing blank or partially filled DIS.
Verify Customer Support Numbers
A common fraud method is impersonating customer support.
Instead of searching randomly for a phone number and calling the first result, use the broker’s official website or application to find its support details.
Be particularly suspicious if a supposed support agent asks you to:
- Share an OTP
- Share your password
- Install an unknown app
- Transfer money to a personal bank account
- Share your screen
- Move funds to a “safe account”
Check Whether an Investment Adviser Is Genuine
Not every person giving stock-market advice online is authorised to provide investment advice.
Before relying on an investment professional, verify the person’s or entity’s regulatory status through official sources.
Be especially cautious about:
- Guaranteed returns
- “Fixed profit” claims
- Insider-tip claims
- Pressure to invest immediately
- Exclusive WhatsApp or Telegram groups
- Requests to transfer money directly to an individual
The security of your Demat account also depends on whom you allow to influence or access your investment activities.
Review Your Account After Changing Brokers or DPs
When changing your broker or Depository Participant, review both your old and new accounts.
Check:
- Securities transferred
- Closing holdings
- New holdings
- Transaction statements
- Pending instructions
- Pledges
- Account-access permissions
This can help identify discrepancies during the transition.
What to Do If You Suspect Your Demat Account Has Been Hacked
If you believe someone has accessed your account, act quickly.
Step 1: Contact Your Broker and DP
Tell them that you suspect unauthorised access.
Ask them to investigate recent:
- Trades
- Transfers
- Pledges
- Login activity, where available
- Other securities transactions
Step 2: Change Your Passwords
Change the affected broker/trading password and your email password if you believe either account may have been compromised.
Use new passwords that you have not used elsewhere.
Step 3: Check Recent Transactions
Download the latest transaction statement and compare it with your own records.
Pay particular attention to unexplained debits and transfers.
Step 4: Preserve Evidence
Keep:
- Screenshots
- Transaction statements
- Emails
- SMS alerts
- Call details
- Complaint numbers
- Relevant messages
Do not delete suspicious messages before recording the details.
Step 5: Report Suspected Fraud
If securities or money have been lost through suspected cyber fraud, report the incident promptly to the appropriate authorities and your financial intermediary.
For securities-market complaints, the applicable DP/depository grievance process and SEBI’s grievance mechanisms may also be used.
CDSL currently provides an online grievance facility for Demat-account holders, including fields for complaint details and supporting documents.
Demat Account Security Checklist
| Security Measure | What You Should Do |
| Password | Use a strong, unique password |
| MFA | Enable it wherever available |
| OTP | Never share it |
| Protect it with MFA | |
| Mobile | Keep registered number updated |
| Apps | Download only from trusted sources |
| Links | Avoid unknown login links |
| Transactions | Review regularly |
| Alerts | Keep SMS/email alerts active |
| DIS | Never sign blank slips |
| Public Wi-Fi | Avoid for sensitive transactions |
| Remote access | Do not install for unknown callers |
| Customer support | Use official contact channels |
| Account access | Never give credentials to others |
Frequently Asked Questions
Can someone hack my Demat account with only my Demat account number?
A Demat account number by itself generally does not provide access to the account. However, investors should still avoid unnecessarily sharing account information and should protect passwords, OTPs and other authentication credentials.
Can someone access my Demat account through my mobile number?
A mobile number alone should not provide direct access to your account, but a compromised mobile number or related communication channels can create security risks. Keep your registered number secure and contact your broker if you notice unusual OTPs or account activity.
Should I share my OTP with my broker?
No. Do not share OTPs with callers or other people. CDSL specifically advises investors not to share or forward OTPs related to Demat transactions.
How often should I check my Demat account?
You can check it regularly, particularly after buying or selling securities, corporate actions or transfers. Investors should review transaction statements for unexplained debits and credits rather than waiting until the end of the year.
What should I do if I receive an OTP without requesting one?
Do not share the OTP or approve any unexpected transaction. Check your account through the official application and contact your broker or DP if you suspect that someone is attempting to access your account.
Is a Demat account completely safe from hacking?
No online financial account can be considered completely risk-free. Security depends on the systems used by the intermediary as well as the investor’s own practices, such as protecting passwords, OTPs, devices and email accounts.
Conclusion
Protecting a Demat account from hacking is mainly about controlling access and detecting unusual activity quickly. Use strong and unique passwords, enable multi-factor authentication, never share OTPs or login credentials, avoid suspicious links and apps, and protect your registered email and mobile number.
Most importantly, regularly check your Demat transaction statement and account alerts. If you find an unauthorised debit, credit or transfer, contact your broker or DP immediately and preserve the relevant records. These simple precautions can significantly reduce the risk of unauthorised access and help you respond quickly if something goes wrong.