Safety Center

Effective 8 October 2026 · Version 1.0

A practical guide for Indo Mail users on keeping an account secure, recognising phishing and the scams most common in India, what Indo Mail does to protect you, and what to do if something goes wrong. Written for individuals, families and small businesses.

1. Welcome to the Safety Center

Most online fraud in India starts with a message: an email, an SMS or a WhatsApp text that looks urgent and asks you to click, pay or share a code. Indo Mail works hard to stop these messages, but no filter is perfect. The best protection is a user who knows what to look for.

This guide is written in plain language. Read it once, share it with family members who are new to email, and come back whenever a message makes you uneasy. The single most important rule is simple: no genuine bank, government office, courier or Indo Mail staff member will ever ask for your OTP, UPI PIN, password or card PIN.

2. Protect your account

Your Indo Mail account is the key to your Drive files, Photos, Contacts, Wallet links and any website where you used this address to sign up. Lock it well.

Use a strong, unique password. At least 12 characters. A short sentence of four or five unrelated words is easy to remember and hard to guess. Never reuse your Indo Mail password on another site.
Keep your mobile number current. Your mobile number is required at sign-up and is used to help you get back in if you lose access. If you change numbers, update it straight away, or ask support@indoemail.in to help.
Add a recovery email. A second address you control gives you another way to recover your account.
Never share an OTP or UPI PIN. A one-time password lets someone act as you. A UPI PIN moves money out of your bank. Indo Mail never sees or asks for your UPI PIN.
Sign out on shared devices. At a cyber café, office computer or a friend's phone, always sign out and do not let the browser save your password.
Keep your device updated. Install system and browser updates promptly. On Android, install the Indo Mail app only from indoemail.in until our Google Play listing launches.
Check the address bar. Sign in only at https://indoemail.in. Fake sign-in pages often use lookalike addresses with extra words, hyphens or swapped letters.

Two-step verification and passkeys are planned for Indo Mail. Until they launch, a strong unique password and an up-to-date mobile number are your best defence.

3. How to spot a phishing email

Phishing is a message that pretends to be from someone you trust so that you hand over money or information. Look for these warning signs:

Urgency or fear. 'Your account will be blocked in 2 hours', 'Legal action will be taken today', 'Last chance to claim your refund'.
A request for secrets. Any message asking for an OTP, PIN, password, CVV, or a photo of your Aadhaar or PAN card.
A mismatched sender. The display name says a well-known bank but the actual address is a free mailbox or a strange domain. Tap or hover over the sender name to see the real address.
Links that do not match. Hover over a link before clicking. If the address it opens is not the organisation's real website, do not click.
Unexpected attachments. Especially .zip, .exe, .apk, .scr, .html, or Office files asking you to 'enable content'.
Too good to be true. Prizes you never entered for, salaries far above normal for little work, investments with 'guaranteed' returns.
Requests to move the conversation. 'Reply on WhatsApp', 'Download this screen-sharing app', 'Call this mobile number, not the official one'.

4. Scams common in India

Criminals adapt quickly, but most scams follow a handful of patterns. Knowing them makes them easy to spot.

Scam	How it works	What to do
Fake KYC update	A message says your bank, wallet or SIM KYC has expired and asks you to click a link or share details to avoid blocking.	Ignore the link. Update KYC only by visiting your branch or using the official app you already have.
Fake job offer	An attractive job or 'part-time task' needs a registration, training or security fee, or asks you to like videos for money and then invest.	Genuine employers do not charge to hire you. Never pay to get a job.
Fake refund or cashback	You are told a refund is waiting and asked to scan a QR code or enter your UPI PIN to receive it.	You never need to scan a QR code or enter a PIN to receive money. A PIN is only for paying.
Invoice or bank-detail change	A supplier or client appears to email saying their bank account has changed and asks you to pay the next invoice to a new account.	Always confirm by calling a phone number you already have on file, never one given in the email.
Lottery or prize	You have 'won' a lottery, lucky draw or car and must pay tax or processing fees first.	If you did not enter, you did not win. Delete it.
Digital arrest	Callers posing as police, CBI, customs, a court or a regulator say a parcel or bank account in your name is linked to a crime. They keep you on a video call, say you are under 'digital arrest' and demand money to 'clear' your name.	There is no such thing as a digital arrest in Indian law. Real officers do not demand money or hold you on video calls. Hang up and call 1930.
Sextortion	Someone befriends you online, records or fakes an intimate video call, then demands money.	Do not pay. Stop contact, keep the evidence, and report at cybercrime.gov.in. Write to abuse@indoemail.in if Indo Mail was used.
Fake customer care	A search result or email lists a fake helpline for a bank, airline or courier. The 'agent' asks you to install a screen-sharing app.	Take helpline numbers only from the official website or the back of your card. Never install a remote-access app at a stranger's request.
Investment and trading	An email or group promises guaranteed high returns on shares, crypto or forex and shows fake profits on a fake app.	Invest only through regulated brokers. Guaranteed high returns are a red flag.

5. How Indo Mail protects you

Indo Mail is built to keep harmful mail and tracking out of your inbox. These protections are live today:

Sender checks. Every incoming message is checked with SPF, DKIM and DMARC, which confirm whether it really came from the domain it claims. Messages that fail are sent to your Spam folder.
Spam folder. Suspected spam goes to Spam, not your inbox. You can mark a message as spam, or not spam, and undo the action if you make a mistake.
Images blocked by default. Remote images in a message are blocked until you choose to show them. This stops senders from using hidden pixels to learn when and where you opened their mail.
Cleaned-up messages. The HTML in every message is sanitised so that hidden scripts and dangerous code cannot run in your browser.
Secure connections. Indo Mail uses HTTPS only, with modern TLS. Mail between servers uses STARTTLS encryption where the other server supports it.
Protected passwords. Passwords are stored only as bcrypt hashes; nobody at Indo Mail can see your password. Repeated failed sign-in attempts are rate-limited.
No trackers. The Indo Mail website and apps load no third-party scripts, fonts or trackers.
Short-lived links. File downloads use signed links that expire quickly.
No ads based on your mail. Free-plan ads are chosen by context only. Indo Mail never reads your mail to target ads.

A scam-warning banner for suspicious messages and user-defined filters are planned for future releases.

6. If you think your account has been hacked

Signs of a hacked account include messages in Sent that you did not write, contacts receiving strange mail from you, a changed password or recovery details, or new forwarding you did not set up. Act quickly:

Change your password at once, from a device you trust. Choose a new password you have never used anywhere.
Check your recovery details. Make sure the mobile number and recovery email are still yours.
Can't sign in? Write to support@indoemail.in from another address. Give your Indo Mail address and the mobile number on the account. We will verify that you are the owner before restoring access.
Warn your contacts that any recent unusual message from you was not genuine.
Check where else you used the same password and change it there too, starting with banking and shopping sites.
Scan your devices with up-to-date security software.
If money was lost, call 1930 immediately. Speed matters: the sooner a bank is told, the better the chance of freezing the money.

If we detect signs that an account has been compromised, such as a sudden burst of outgoing spam, we may pause sending or lock the account to protect you and your contacts, and help you regain control.

7. Reporting abuse to Indo Mail

If you receive a phishing, scam, harassing or illegal message from an Indo Mail address, or find a harmful Drive share link, Business Profile or ad, please tell us.

Email abuse@indoemail.in.
Attach the message as a file, or forward it with full headers, so we can trace it.
For a link, Business Profile or ad, include the full web address.
Mark reports about children or intimate images 'URGENT' in the subject line.
Use the Spam button in your inbox for ordinary spam; it helps train our filters.

We review every report. We may not be able to tell you the outcome in detail, because the other account holder also has privacy rights, but we will confirm we have received it.

8. Reporting to the authorities in India

Indo Mail can act on its own service, but only the police can investigate and prosecute crime. If you are a victim, report it.

National cybercrime helpline: 1930. Call as soon as possible after losing money to online fraud.
National Cyber Crime Reporting Portal: cybercrime.gov.in. Report any cybercrime, including anonymous reports about crimes against women and children.
Suspected fraud communication: you can report suspicious calls, SMS and messages through the Chakshu facility on the Department of Telecommunications' Sanchar Saathi portal.
Emergency: dial 112 if you or someone else is in immediate danger.
Your bank: call the number printed on your card or passbook to block cards or accounts.

Keep evidence: do not delete the scam emails, screenshots, transaction IDs or phone numbers. Police may need them. If police ask Indo Mail for information about the account that contacted you, they should write to legal@indoemail.in.

9. Safety for businesses

Businesses are targeted because they move larger sums. If you use Indo Mail on your own domain, follow these practices:

Verify payment changes by phone. Treat every request to change bank details, or to make an urgent payment, as suspicious until confirmed on a known phone number.
Use two people for large payments. One person prepares, another approves.
Keep SPF, DKIM and DMARC records in place. They stop criminals sending mail that looks as if it came from your domain. Move your DMARC policy towards 'quarantine' or 'reject' once your legitimate mail passes.
Manage staff accounts. Use the admin console to remove leavers on their last day and reset passwords when devices are lost.
Train your team. Share this page and run short refreshers on new scam types.
Protect customers. Tell customers how you will and will not contact them, and that you will never ask for their OTP or PIN.
Get a verified business badge for your Business Profile so customers can tell your real profile from copies.

10. Safety tips for families

Indo Mail accounts are for adults aged 18 and over. Many older parents and grandparents in India are coming online for the first time and are frequent targets.

Sit with family members while they set up their account and choose a strong password.
Agree a family rule: never act on a money request by email or phone without first calling a family member.
Explain that police and courts never demand money on video calls.
Show them where the Spam folder is and how to report a message.
Read our Child Safety page for guidance on protecting children online.

11. Contact

Report abuse or scams: abuse@indoemail.in. Account help and recovery: support@indoemail.in or help@indoemail.in. Report a security weakness in Indo Mail: security@indoemail.in. Complaints about how a report was handled: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in.