Fake SEBI Check and Verification Tools — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 28, 2026

Severity: HIGH | View Full Scam Details

Beware the Fake SEBI Verification Tool Scam in India 2026: Stay Safe from Fraudulent UPI and WhatsApp Offers

A rising cybercrime in India involves fake SEBI verification websites and tools that trick investors via WhatsApp and fraudulent UPI requests, risking serious financial loss.

What Is the Fake SEBI Check and Verification Tools?

In 2026, scammers impersonating the Securities and Exchange Board of India (SEBI) have increasingly targeted retail investors and traders looking to verify brokerage firms or investment platforms. These cybercriminals design fake websites or mobile apps with URLs closely resembling the official SEBI domain (sebi.gov.in) — for example, sebi-verification.in or sebi-secure.com — to lure unsuspecting users into trusting their illegitimate services.

This scam primarily preys on individuals active in online stock trading, mutual fund investments, and digital wealth management, especially those who look for quick SEBI accreditation checks to avoid fraud. Victims are often directed to these fake tools via WhatsApp groups discussing stock tips or shared links in social media forums, where financial discussions flourish.

According to cybercrime reports collected by Indian authorities, the misuse of lookalike domains and manipulated URLs is an increasingly common pattern. While SEBI itself has issued advisories reminding the public only to use its official website and not rely on third-party verification tools, scammers continue exploiting gaps in user awareness. CERT-In and I4C have also circulated warnings about fraudulent digital verification sites gaining traction on messaging platforms, underscoring the prevalence of this threat across India.

How This Scam Works — Step by Step

1. Initial Contact via WhatsApp or Social Media: You receive a WhatsApp message or see a shared link in an investment-focused group claiming to offer SEBI verification of brokerage firms or investment platforms to help you find “safe” options.

2. Redirect to Fake Website or App: Clicking the link brings you to a website or app with a SEBI-like appearance and domain name. It asks you to enter details such as the broker’s name, UPI ID, or Aadhaar number for verification.

3. Data Harvesting and Fake Verification: The site or app “processes” your input and then shows forged verification results stating the broker is legitimate or certified by SEBI. Sometimes, it insists you pay a nominal fee for detailed reports using UPI or UPI apps like Google Pay, PhonePe, or Paytm.

4. UPI Payment or KYC Data Capture: To “complete verification,” you’re asked to authorize a UPI payment or share KYC details. The payment either goes to the scammer’s account or initiates a UPI mandate allowing multiple deductions.

5. Financial Theft and Identity Misuse: Once data or payment authorization is obtained, scammers withdraw money instantly via UPI, misuse Aadhaar data to open fraudulent accounts, or engage in SIM swap attacks to bypass OTPs and empty your bank account.

6. Communication Ends Abruptly: After the money transfer or data theft, the fake verification site disappears or becomes inaccessible, and the WhatsApp number or social media profile stops responding.

Real Warning Signs to Watch For

• Domain names slightly different from official SEBI URLs (e.g., “sebi-verification.in” vs “sebi.gov.in”)
• Requests to make UPI payments upfront for a “free” verification service
• Links shared mainly in WhatsApp groups or unofficial social media forums, not from SEBI’s social accounts
• Poor website design with spelling errors, inconsistent formatting, or lacking HTTPS security lock icon
• Pressure to share sensitive KYC details like Aadhaar, PAN, or UPI pin
• Verification results that seem too good to be true or overly generic certificates
• Lack of contact information or verifiable customer support for the verification tool

What Happens to Victims

Victims often face immediate financial loss as money is silently transferred from their bank accounts via UPI or fraudulently authorized mandates. Since UPI payments in India can be instantaneous and irreversible, recovering money can be difficult unless reported promptly to the bank and RBI. Beyond finances, stolen Aadhaar or PAN data can lead to identity theft, opening fake accounts or loans in the victim’s name.

Emotionally, victims suffer stress and loss of trust in digital investment methods. The impact is worsened when SIM swap fraud is involved, as scammers intercept One-Time Passwords (OTPs) and bypass mobile-based authentication, making account recovery complex and time-consuming.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) continuously reminds users to verify payment requests carefully and avoid sharing UPI PINs or OTPs with anyone. RBI’s helpline and grievance portal offer assistance for unauthorized transactions.

CERT-In, India’s cybersecurity agency, has issued advisories urging users to only access official government websites for financial verification and to be vigilant about phishing attempts on messaging apps like WhatsApp. The Indian Cyber Crime Coordination Centre (I4C) encourages reporting suspected cyber fraud to the national cybercrime portal at cybercrime.gov.in and contacting the 1930 helpline for immediate assistance.

How to Protect Yourself

1. Always type SEBI’s official website URL (sebi.gov.in) directly in your browser; avoid clicking unknown links from WhatsApp or social media.
2. Never make payments or share UPI details through unverified third-party sites claiming to offer verification.
3. Do not share Aadhaar, PAN, UPI PINs, or OTPs with unknown contacts or via suspicious apps.
4. Confirm broker or investment platform authenticity directly from SEBI or recognized financial portals.
5. Check the website URL carefully for subtle misspellings or domain variations before entering personal data.
6. Use official government apps or portals for KYC and verification-related services only.
7. Immediately report suspicious messages or payment requests to your bank and block the sender on WhatsApp.

What to Do If You’ve Been Targeted

1. Contact your bank immediately to block your UPI ID and debit cards linked to the transaction.
2. File a complaint at cybercrime.gov.in under the “Financial Fraud” or “Phishing” category.
3. Report the incident to the 1930 Cyber Crime Helpline available across India for guidance.
4. Inform your mobile operator if you suspect SIM swap fraud to secure your phone number.
5. Lodge a police complaint with all evidence such as screenshots, transaction IDs, and chat records.
6. Change passwords and UPI PINs for all linked financial apps and Aadhaar-linked services.
7. Monitor bank statements and credit reports for unusual activity, and claim refunds through RBI’s complaint process if unauthorized transactions occur.

Frequently Asked Questions

Q: Can I verify my broker's SEBI registration on any app or website?
A: No. Official broker verification must be done only via SEBI's official website (sebi.gov.in). Avoid third-party apps or websites offering verification as they may be fraudulent.

Q: What should I do if I accidentally entered my Aadhaar or UPI details on a fake site?
A: Immediately block your UPI transactions through your bank, change all related PINs, and file a complaint on cybercrime.gov.in. Contact the 1930 helpline for help with Aadhaar misuse.

Q: Is a UPI payment to verify SEBI accreditation legitimate?
A: No. SEBI does not charge fees for investor or broker verifications through third-party payment links. Any such payment requests should be treated as suspicious.

Do you encounter suspicious SEBI verification messages or apps? Verify before you trust — visit BharatSecure.app and report fraud promptly using the 1930 helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.