How to Keep Your Credit Card Safe for Online Payments

Most credit card fraud in India today doesn't happen through stolen physical cards — it happens through online checkout flows, phishing links, and social engineering that tricks cardholders into handing over an OTP themselves. A few consistent habits close off almost all of these attack paths.

Never share your OTP or CVV over a call

No genuine bank representative will ever ask for your OTP, CVV, or full card number over a phone call, SMS, or email. If someone claiming to be from your bank asks for these details to "verify" or "reverse" a transaction, hang up and call the number printed on the back of your card instead.

Use virtual card numbers for online checkout

Many issuers now offer virtual card numbers — a disposable or masked card number linked to your real account, usable for a single merchant or a limited time. Using a virtual number for online purchases means that even if a merchant's checkout page is compromised, your actual card number is never exposed.

Check for HTTPS and merchant legitimacy before checkout

Before entering card details on any site, confirm the URL uses HTTPS and that the merchant is one you recognize. Fraudulent lookalike sites mimicking well-known e-commerce brands are a common vector, especially around sale seasons — a slightly misspelled domain is often the only tell.

Set transaction alerts and limits

Enable SMS and app notifications for every transaction, and where your issuer allows it, set a lower per-transaction limit for online purchases specifically. A lower limit doesn't stop fraud attempts, but it caps how much damage a single compromised transaction can do before you notice and act.

Freeze your card instantly if something feels off

Most banking apps now let you freeze a card instantly from your phone without calling customer care. If you see an unrecognized transaction or suspect your details were exposed, freeze the card first and investigate after — the few seconds of friction from freezing is trivial next to the cost of a fraudulent charge going through.

Avoid saving card details on unfamiliar sites

Saving card details for convenience is fine on major, well-established platforms with strong security track records, but avoid it on smaller or unfamiliar merchant sites — a data breach at a smaller merchant is far more likely, and a saved card number there is a lasting liability.

Where to go from here

Read our full credit card fraud protection guide for what to do if a fraudulent transaction has already gone through, including chargeback and dispute timelines.