⚡ Quick answer
To secure your demat and trading account, use a unique password, protect your registered email and mobile number, never share OTPs or TPINs, enable SMS and email alerts, use only the authorised broker application and verify every trade, contract note, fund balance and demat transaction.
If you receive an alert for a trade, debit, pledge or account change that you did not authorise, contact the broker or depository participant immediately in writing, preserve the evidence and escalate through the relevant exchange, depository or SEBI complaint route if the issue is not resolved.
What Does It Mean to Secure a Demat and Trading Account?
A trading account and a demat account perform different functions, but they are closely connected.
The trading account is used to place buy and sell orders. The demat account holds securities electronically after settlement.
Account security therefore has two goals:
- prevent unauthorised access or transactions; and
- detect suspicious activity quickly.
SEBI Investor describes account security as protecting online investment accounts, trading accounts and demat accounts from unauthorised access and loss of control. Its central guidance is simple: never share your password.
Readers who need the account basics should first review What Is a Demat Account?, What Is a Trading Account? and Demat Account vs Trading Account.
Why Demat and Trading Accounts Are Targeted
These accounts can provide access to securities holdings, trading funds, margin facilities, bank-linked withdrawals and personal information.
Fraudsters may try to obtain access through fake trading applications, impersonated broker support, account-handling services, screen-sharing software, phishing links, stolen email access or unknown mobile applications.
The account may be genuine while the person requesting access is fraudulent.
The warning framework in Fake Trading Apps and Telegram Stock Tips remains relevant whenever someone asks the investor to install software or use a private platform.
Never Share Login Credentials
NSE’s investor guidance states that investors should not share their login ID, password, OTP or TPIN with anyone, including employees of the broker or an authorised person.
This applies even when the person claims to be a relationship manager, dealer, technical-support executive, adviser, analyst, portfolio expert or account handler.
A genuine support process should not require the investor to surrender account control.
SEBI’s February 2026 caution on account-handling scams explains that fraudsters may describe themselves as expert fund managers or PMS providers, request trading credentials and place trades directly in the investor’s account. They seek a share of any profit while the investor bears the loss.
Use Strong and Separate Passwords
A strong password should be unique to the trading account, different from the email password, difficult to guess and changed immediately after suspected exposure.
Avoid using a name, birthday, mobile number, broker name, repeated characters or the same password used on social media.
The registered email account deserves equal protection because password-reset links and statements may be delivered there.
Use a strong device lock and avoid saving credentials on a shared computer or browser.
Protect Your Registered Mobile Number and Email
SEBI Investor advises investors to keep their mobile number and email ID updated with the broker and depository participant.
These details are used for trade alerts, demat transaction alerts, contract notes, balance statements, password resets and account-change notifications.
If the number or email changes, update the record through the prescribed process.
Do not ignore unexpected loss of mobile service, unexplained email-password resets or alerts that contact details were modified.
Enable SMS and Email Alerts
SEBI Investor states that investors can receive free SMS and email alerts for trading and transaction activity in trading and demat accounts.
CDSL’s SMART facility sends alerts for demat debits and certain credits, including IPO allotments and corporate actions. CDSL describes SMS alerts as an effective risk-control mechanism for monitoring a demat account.
Alerts may cover executed trades, demat debits, pledge creation, account-detail changes, funds and securities balances and corporate-action credits.
The alert is useful only when the investor reads and verifies it promptly.
Match Every Trade With Your Instructions
A trade should correspond with an order you placed or authorised.
Check the security name, buy or sell direction, quantity, price, time, segment, product type and charges.
NSE advises investors to ensure that all trades are executed according to their instructions and to review the trading account periodically.
Unexpected trades should be reported in writing immediately. A verbal conversation alone may be difficult to prove later.
Verify Contract Notes and Broker Statements
A contract note is a formal record of trades executed through the broker.
Check the client code, order and trade details, brokerage, taxes, statutory charges and settlement information.
Compare the contract note with the broker application, exchange SMS or email, bank movements and demat holdings.
SEBI Investor advises investors to insist on a valid contract note or confirmation memo and to keep statements, payment records and signed documents.
Monitor the Demat Account and CAS
Review the demat account for securities credited, securities debited, pledge creation or release, corporate-action credits and changes in nominee or master details.
CDSL advises account holders to use its internet-based monitoring facility and SMART alerts, check transaction statements and contact the depository participant when an unauthorised debit or credit appears.
The Consolidated Account Statement provides a combined view of demat securities and mutual-fund holdings linked through the relevant records.
SEBI Investor explains that CAS shows transactions across mutual funds and securities held in demat accounts.
Understand OTP, TPIN, e-DIS, DDPI and PoA
OTP
An OTP confirms a specific action or login. It should never be shared.
TPIN
A TPIN may authorise the debit of securities through an electronic delivery process. Treat it as confidential.
e-DIS
Electronic Delivery Instruction Slip processes allow investors to authorise specified demat debits electronically.
DDPI
A Demat Debit and Pledge Instruction can permit limited activities connected with settlement, pledging and specified exchange-platform transactions.
NSE’s investor guidance states that DDPI or Power of Attorney should not be insisted upon merely for opening an account and that DDPI should be used only for permitted purposes.
Power of Attorney
Before granting a PoA, understand exactly what powers are being provided. Avoid broad or unnecessary authority.
Avoid Remote Access and Unknown Applications
Do not install unknown applications or enable remote control because someone claims to be helping with KYC, account activation, withdrawal, technical support, password reset, portfolio management or loss recovery.
CDSL warns investors not to download unknown applications because they may secretly access confidential information.
Use only the authorised mobile application connected with the verified broker. Confirm the official app through independent broker, exchange or SEBI Investor resources.
Verify the Broker’s Payment Account
Before transferring trading funds, verify the broker’s bank-account details through the broker’s genuine website or the relevant exchange facility.
NSE advises investors to verify broker bank details before transferring funds and warns against cash or third-party payments.
Never transfer trading money to an employee, account handler, local representative, Telegram administrator, unrelated merchant or personal UPI account.
A real trading account does not make an unrelated payment route safe.
Account-Handling and Profit-Sharing Scams
An account handler may say that the investor provides the capital, the handler operates the account and the profit is shared.
The investor may see genuine trades in the real account, but the arrangement can still be unauthorised and dangerous.
Use the Stock Return Calculator to test screenshots or claimed gains.
For repeated monthly or annual return claims, use the CAGR Calculator.
For a specific trade setup, use the Risk–Reward Calculator before placing the order yourself.
Calculators can expose unrealistic claims, but they do not make credential-sharing or account handling safe.
What to Do After a Suspicious Transaction
Stop Further Access
Change trading and email passwords. Remove unknown devices or application permissions where possible.
Contact the Broker or DP
Use verified support details and report the transaction in writing.
Preserve Evidence
Save alerts, contract notes, screenshots, device notifications, chats, beneficiary details and complaint numbers.
Check Other Accounts
Review the linked bank account, email and mobile access.
Request Relevant Records
Ask for order logs, call records where maintained, device-login details and transaction documentation.
Escalate Promptly
Delay can make investigation and recovery more difficult.
Complaints About Unauthorized Trades
An unauthorised trade is a trade executed without the investor’s consent or valid instruction.
NSE’s 2025 penalty circular describes unauthorised trading as including trades induced or executed through unfair means, such as obtaining a client’s user ID and password and trading without consent.
The complaint should identify disputed trades, dates, when the investor learned of them, alerts received, communication with the broker, financial impact and evidence of non-authorisation.
Approach the broker first. If unresolved, use the applicable exchange, depository, SCORES or online dispute-resolution route.
Demat and Trading Account Security Checklist
Confirm the following:
- I use a unique trading-account password.
- My email account has a separate strong password.
- My registered mobile number and email are current.
- SMS and email alerts are active.
- I read every trade and demat alert.
- I verify contract notes and statements.
- I review demat holdings and CAS regularly.
- I never share password, OTP or TPIN.
- I do not allow account handling.
- I use only the authorised broker app.
- I avoid remote-access software.
- I verify the broker payment account.
- I understand DDPI and PoA permissions.
- I report unexplained activity immediately.
- I preserve written evidence and complaint numbers.
The Regal Ticker Investor Tools hub can help investors independently test return and trade-risk claims before acting.
Final Takeaway
Demat and trading account security is an ongoing process.
A strong password is important, but it is not enough. Investors also need secure email and mobile access, active alerts, regular account monitoring, careful use of OTPs and TPINs, verified applications and payment accounts, and immediate written reporting of discrepancies.
The safest account is one the investor actively controls and regularly checks.
Frequently asked questions
Can I share my trading password with a broker employee?
No. NSE advises investors not to share login IDs, passwords, OTPs or TPINs with anyone, including broker employees or authorised persons.
What should I do after receiving an unknown trade alert?
Check the account immediately, contact the broker in writing, preserve the alert and request the relevant trade records.
Are SMS and email alerts chargeable?
SEBI Investor states that investors can receive SMS and email alerts for trading and demat activity free of cost.
What is CDSL SMART?
SMART is CDSL’s SMS Alerts Related to Transactions facility, which provides alerts for demat debits and certain credits and account changes.
Should I share my TPIN with a dealer?
No. TPIN is a confidential transaction authorisation and should remain under the investor’s control.
Is account handling safe if trades happen in my real broker account?
No. The use of a genuine account does not make an unregistered account-handling arrangement safe. SEBI has cautioned investors against sharing credentials with account handlers.
How often should I review my demat and trading accounts?
Review trade alerts daily when active, contract notes after transactions and demat or consolidated statements regularly.
Where can I complain about an unauthorised trade?
First complain to the broker in writing. If unresolved, escalate through the applicable exchange, depository, SEBI SCORES or online dispute-resolution mechanism.
Verify through official sources
Official references
- 1. [SEBI Investor — Secure Your Investment Account](https://investor.sebi.gov.in/secure_ur_inv_account.html)
- 2. [SEBI Investor — SMS and Email Alerts to Investors](https://investor.sebi.gov.in/sms_email_alerts.html)
- 3. [SEBI Investor — Securities Market Investment Do’s and Don’ts](https://investor.sebi.gov.in/securities-dos_and_donts.html)
- 4. [SEBI Investor — Consolidated Account Statement](https://investor.sebi.gov.in/consolidated_account_statement.html)
- 5. [SEBI — Caution on Account-Handling Services, February 2026](https://www.sebi.gov.in/sebi_data/attachdocs/feb-2026/1772113926582.pdf)
- 6. [NSE — Investor Do’s and Don’ts](https://www.nseindia.com/static/invest/first-time-investor-fraud-dos-and-donts)
- 7. [NSE — Unauthorized Trades Penalty Structure, February 2025](https://nsearchives.nseindia.com/content/circulars/ISC66828.pdf)
- 8. [CDSL — SMART SMS Alerts](https://www.cdslindia.com/Footer/Smart.html)
- 9. [CDSL — Demat Account Dos, Don’ts and Best Practices](https://www.cdslindia.com/common/DownLoadFile.aspx?action=communique&eventid=DP2022-409)
- 10. [NSDL — SMS Alerts for Demat Transactions](https://nsdl.co.in/downloadables/pdf/2017-0029-Policy-SMS%20Alert%20facility%20enhanced-%20SMS%20Alerts%20to%20Clients%20upon%20Pledge%20instruction%20initiation%20and%20confirmation.pdf)
Educational disclaimer: This article is for education and general information only. It does not provide investment, legal, cybersecurity or financial advice. Account features, authorisation methods and complaint procedures may vary by intermediary and may change. Verify current instructions through the broker, depository, exchange and SEBI before acting.
