A Genuine Website, a Fake Purpose: How Fraudsters Use Online Forms to Steal Banking Details

We have all filled in an online form at some point: a college registration, an event sign-up, a feedback survey. Tools like Google Forms have made this easy for everyone. Unfortunately, they have also made it easy for fraudsters, who need only a few minutes to build a form that looks convincing and a link to send it. This offence belongs to the wider family of social engineering fraud, where the victim is manipulated into handing over what the criminal needs.

What the fraud looks like

The victim receives a message, call or email containing a link to an online form. The story is usually about money: a refund that is due, a payment that failed, a cashback waiting to be credited. The sender says the form needs to be filled to get the money back.

Once opened, the form looks harmless. It may be titled something like "Online Payment Refund" and ask for your name, the amount, and a UPI or card-related detail. Some versions go further and ask for your ATM card number, UPI PIN or a password.

The moment you press submit, everything you typed goes straight to whoever created the form. The fraudster does not need to hack anything. You have delivered the information yourself. With those details they log in or approve payments, and the money leaves your account.

Why a real platform makes it more dangerous

Most of us have learned to distrust strange websites. This fraud does not use one. The link leads to a real, well-known service, the address bar shows a familiar name, and the page loads quickly and neatly.

That sense of familiarity is the trap. A legitimate platform tells you nothing about the intention of the person who built the form. Anyone with an account can create one in minutes, and the owner of the form receives every answer. The platform is a tool, and tools can be used by anyone.

Shortened links add to the problem. A link that has been compressed into a few characters hides where it actually goes, so it is harder to judge before you click.

Why people fill it in

• The promise of money. A refund or cashback is something people are happy to receive, and that goodwill lowers their guard.

• A believable process. Asking customers to fill a form is common for businesses, so it does not sound unusual.

• Casual design. A short, tidy form feels low-risk, unlike a long, official-looking document.

• Haste. Messages usually include a deadline, such as "claim within 24 hours", which discourages checking.

The one rule that settles it

Banks do not collect confidential details through online forms. A genuine bank will never send you a form asking for your card number, UPI PIN, password or OTP, and it will never need you to prove who you are by typing a PIN into a survey page.

In fact, Google Forms itself carries a notice at the bottom of forms reminding users never to submit passwords. If a form asks for sensitive banking information, the form is the red flag.

Warning signs

• A refund or reward you were not expecting, arriving by message, call or email.

• A form asking for card details, PINs or passwords, which no refund requires.

• A link sent by a stranger, or a shortened link you cannot read.

• Pressure to complete it immediately.

• A caller who stays on the line while you fill it in.

Stay protected

1. Never enter your ATM number, UPI PIN, passwords or OTP in an online form.

2. For refunds, go to the app or website of the company or bank itself, not a link sent by someone else.

3. Check the sender's identity independently before you click anything.

4. Be especially careful with unexpected links, even if they look professional.

5. Tell family members, particularly older relatives, how this works.

The legal angle

This kind of offence is generally dealt with under the Information Technology Act, 2000, notably Section 66C (dishonest use of identifying information) and Section 66D (cheating by personation using a computer resource), together with the cheating provisions in the Bharatiya Nyaya Sanhita. Which sections apply depends on the facts of each case and the investigating agency's view.

If you have already submitted the form

1. Call your bank immediately and ask them to block your cards and UPI, and to flag the transactions.

2. Change passwords and PINs on any account that shares them.

3. Call the National Cyber Crime Helpline, 1930, without delay.

4. File a complaint at cybercrime.gov.in.

5. Save the link, screenshots of the form, the messages and the transaction details.

6. Report quickly. Under RBI's framework for unauthorised electronic transactions, reporting within three working days generally gives the customer a stronger position where the fault does not lie with them. Because the victim in this scam hands over the details, banks may question whether the transaction was authorised, so keep every record.

A closing thought

There is nothing wrong with online forms. The danger lies in the mix of a trusted platform and a request that does not belong there. A simple test works every time: if a form asks for the keys to your bank account, do not fill it in. No refund in the world requires your PIN.