DIGITAL HYGIENE AND SECURITY HABITS

DIGITAL HYGIENE AND SECURITY HABITS

How We Pay and Protect Ourselves Online?

This piece condenses Chapters 7 and 8 of the Status of Policing in India Report 2026 (published by Common Cause and Lokniti-CSDS), which draws on face-to-face surveys of 8,306 respondents, conducted in 16 states and one UT across India. Chapter 7 maps how Indians pay online and how safe they feel doing so; Chapter 8 examines what they actually do to protect themselves. Read together, they describe a country that has adopted digital finance faster than it has learned to secure it.

India’s digital payment habit has outrun its security habits. Almost half of respondents use UPI every day. Yet one in five does not use two-step verification, and the respondents most prone to risky behaviour are the most likely to call online banking very safe.

A country that Pays by Phone

Digital payments have become deeply embedded in everyday financial transactions. UPI is by far the most widely used digital payment mode. Almost half of respondents (49 per cent) use a UPI app daily and another quarter (24 per cent) weekly; only 17 per cent have never used one. Mobile banking apps and net-banking sites are used daily by just 22 per cent, and a third (34 per cent) have never used them. Specialised products remain a minority pursuit: 55 per cent have never used online investment services, and two in three (66 per cent) have never tried a digital loan app (Table 3).

The advantages of this digital expansion are however not equally distributed. Men, urban residents and the affluent are the heaviest users of online payments: 31 per cent of men are high users against 21 per cent of women; 29 per cent of urban respondents against 18 per cent of rural ones; and 42 per cent of the richest against 16 per cent of the poorest.

The Confidence Trap

UPI was rated as the safest payment channel by the respondents, with over a third of the respondents (34 per cent) finding it “very safe”, and another two in five (41 per cent) reporting it to be “somewhat safe”, bringing the combined positive perception to about three-fourths of the respondents – 75 per cent. The combined proportions of debit and credit cards (65 per cent), wallet apps (64 per cent), mobile banking apps (60 per cent) and internet banking sites (50 per cent) rank below it. Digital loan apps and stock-trading platforms inspire far less confidence: Only 8 per cent rate each very safe, while 47 per cent and 46 per cent respectively consider them unsafe. Taking the five mainstream modes together, 63 per cent of respondents consider online banking safe (23 per cent very safe, 40 per cent somewhat safe) and 37 per cent consider it unsafe.

Victimisation is higher among the most active and most confident users. Of respondents who use UPI many times, 16 per cent reported being victims of cybercrime in the previous two to three years, against 7 per cent of non-users; the report links this to greater exposure, and finds that use of other payment modes makes little difference. Among respondents who rate online banking very safe, 28 per cent were victims or close aides of victims, twice the 14 per cent among those who rate it very unsafe.

It is important to note how usage breeds trust: The most used modes and apps are the most trusted, while loan apps and trading platforms are used little and viewed with scepticism. This trust also extends to telecom providers, which sit at the centre of many frauds: 74 per cent of respondents trust their provider a lot (26 per cent) or somewhat (48 per cent) to keep their number and personal information safe, which the report reads as a notable sign of public confidence.

While most respondents report cautious behaviour when dealing with unknown callers and messages: 68 per cent say they never share an OTP or press a button when asked to do so, while 56 per cent never click unknown links or open unknown files. A sizeable minority engages in such behaviour at least sometimes, with 14 per cent sharing OTPs and 21 per cent pressing a button. On the report’s vulnerability index, 10 per cent of respondents are highly vulnerable to unsolicited calls and texts, while 23 per cent are moderately vulnerable.

Paradoxically, respondents who are most likely to click unknown links, open unfamiliar files, follow a stranger’s instructions or share an OTP are also more likely to consider online banking very safe. Nearly half (49 per cent) of the most vulnerable group rate online banking as very safe, compared with about 20 per cent of the least vulnerable (Figure 10). The report identifies this combination of low vigilance and high confidence as a potential risk factor for cybercrime, highlighting the need for awareness campaigns that foster a more realistic understanding of online threats.

The Safeguards People Use

Chapter 8 examines the practical steps respondents take to protect themselves. Two-step verification, which requires users to complete an additional authentication step, is one of the basic safeguards available for digital financial transactions. Yet, its use remains far from universal.

Among respondents, 55 per cent report using two-step verification on UPI apps, compared with 38 per cent on internet banking apps. One in five (20 per cent) does not use it for UPI transactions, while 12 per cent are unaware of the facility. For internet banking, 26 per cent do not use two-step verification and 16 per cent do not know about it.

The differences in adoption follow familiar patterns of digital inequality. Among respondents below the age of 25, 68 per cent use two-step verification on UPI apps. Among those aged 56 and above, the figure falls to 31 per cent. Lower usage of UPI among older respondents partly explains this gap: One in five people in the oldest age group do not use UPI at all, compared with 4 per cent of the youngest respondents.

Education is another important dividing line. While 71 per cent of college graduates use two-step verification on UPI apps, the figure falls to 26 per cent among respondents who are non-literate. Urban respondents are somewhat more likely than rural respondents to use the safeguard (57 per cent compared with 48 per cent). The gap between the richest and poorest is wider, at 68 per cent and 43 per cent, respectively.

These disparities reveal how differences in access and familiarity can carry over into security practices. People who have had fewer opportunities to use digital financial services are also less likely to use the safeguards available within them. Awareness of a security feature, access to it and the ability to use it confidently are distinct requirements, and each needs attention.

The findings also caution against treating the adoption of a particular safeguard as a complete measure of digital safety. Two-step verification can strengthen account security, but users continue to encounter risks through unsolicited calls, fraudulent links, misleading websites and requests for personal information. Protection depends on a combination of technical safeguards and everyday decisions.

Awareness Without Everyday Habit

Cybersecurity awareness campaigns have reached a large proportion of respondents. Some 45 per cent of respondents have both received a cybersecurity message and seen an advertisement, 21 per cent have only received a message and 22 per cent have only seen an advertisement; just 7 per cent have seen neither (Figure 11).

However, exposure to these messages has not translated into routine practice. Receiving a warning about cybercrime does not automatically translate into checking an app's permissions, avoiding password reuse or verifying the authenticity of a website before entering personal details.

The report's digital hygiene index examines several such practices, including avoiding public Wi-Fi, not saving passwords in browsers, checking app permissions, avoiding password reuse and verifying website or app authenticity. The findings show that secure habits are far from routine for many respondents. Across these practices, roughly a quarter report always following the recommended precautions, while similar or larger proportions say they never follow them.

For instance, 27 per cent always avoid using public Wi-Fi, while 27 per cent never do so. A quarter (25 per cent) always check app permissions, but 29 per cent never do so. Nearly a third (29 per cent) never avoid reusing passwords, and 31 per cent never verify the authenticity of a website or app.

Awareness is an important starting point, but the report shows that it cannot be treated as evidence that these habits have taken hold.

Digital hygiene also varies by age, education and location. A quarter (25 per cent) of respondents below the age of 25 always follow secure practices, compared with 15 per cent of those aged 56 and above. Among the oldest respondents, 36 per cent never follow such practices. The proportion who always follow them rises from 15 per cent among non-literate respondents to 27 per cent among graduates. Urban respondents are also more likely than rural respondents to report always following secure practices; at 22 per cent and 17 per cent, respectively.

These differences mirror the inequalities observed in the use of digital financial services and two-step verification. Digital safety depends partly on whether people have the knowledge, confidence and opportunity to make informed choices. Campaigns that rely on written messages or general warnings may have limited value for users who need practical guidance on how to recognise a scam or change a security setting.

Closing the Digital Literacy Gap

The two chapters describe a system that has scaled faster than its safeguards. The groups least integrated into digital finance, including women, the poor, rural residents and older users, are less likely to use basic protections, and the most confident users are the likeliest to be victimised. The report concludes that digital financial inclusion should be paired with targeted literacy programmes for women, older users and lower-income groups, who use digital finance less but are not necessarily less exposed to its risks, and that awareness campaigns should teach practical skills, risk awareness and safer behaviour.