Security advice tends to be either obvious or unhelpful. "Use a strong password" is true and everyone's heard it. "Enable two-factor authentication" is good advice until you realise the second factor here is already an SMS code, and SMS codes are exactly what scammers ask for.

So let's skip the obvious and talk about the things that actually go wrong. Most account compromises don't involve anyone cracking anything. Someone hands over a code, or types a password into the wrong page, or installs a file that reads their messages. The technical barrier is low because it doesn't need to be high.

Here's what to focus on.

The password, briefly, because it matters less than you think

It matters. It's just not where most breaches start.

Long, unique, stored somewhere other than your memory. Long rather than clever — a short phrase does more work than a symbol mash and you'll actually remember it. Unique, because a password reused between here and your email means a breach on either side opens both.

That's it. If you've done those two things, you're ahead of most people and further advice won't add much. If you haven't, do it now rather than reading on.

What matters more is what happens around the password.

The OTP is the actual weak point

Your password lives in your head or your password manager. Your OTP arrives as a message, sits on a lock screen, and can be read out loud by someone who's been persuaded.

Which is why it's the target. Every scam in this space eventually arrives at the same request: give me the code. Sometimes it's dressed as verification. Sometimes as a withdrawal release. Sometimes as a security check because "someone tried to access your account."

Nobody from support will ever ask for your OTP. Not on a call, not in a chat, not through a message that looks official and knows your name. That code proves whoever holds the phone is the account holder, and the moment you share it, that proof belongs to someone else.

Same applies to your password. No legitimate support team needs it, for any reason.

The pattern worth recognising

Someone contacts you first. They already know something about your account — your name, or part of your number, which they got from a leak or a guess. They create mild urgency. Then they ask for the code.

Real support doesn't cold-call you asking for credentials. If you're ever unsure, close the conversation and contact support through the Rajabets website yourself. If the call was genuine, they'll know what you're talking about.

Check the page every time, not just the first time

This is the habit that prevents the most damage, and it's the one people drop once they feel comfortable.

Open the address bar and read the whole domain. Look for an extra letter, a hyphen that shouldn't be there, an "l" swapped for a "1", an "o" swapped for a zero. On a phone, tap the bar so the full URL expands — mobile browsers truncate, and the end of the domain is where lookalikes differ.

Check the padlock. Its presence proves less than people assume, since certificates are free and scammers get them too. Its absence is a firm no.

Scroll to the footer. Terms, privacy, contact details. They should exist and the links should work.

Then bookmark the Rajabets website you've verified and use the bookmark from then on. Not a search result, not a link someone sent. The bookmark. That single habit removes the whole category of fake-page risk, and it takes one minute to set up.

Your device is part of the account

An account is only as private as the phone it's accessed from. A few things worth doing.

Lock the phone. Obvious, and it's what stops someone reading your OTP off a lock screen.

Review app permissions. If you installed an app for the platform, check what it can access under Settings → Apps → [app] → Permissions. Internet access, notifications, maybe storage. Not SMS, not accessibility services, not the ability to draw over other apps. Those three are how messages get read and screens get faked. If you see them, uninstall and change your password from a browser.

Keep the OS updated. Security patches are dull and they close things that are actively being exploited.

Be careful with screen sharing. Anyone asking you to install a remote-access app so they can "help" is not helping. That gives them your screen, and your screen has your OTP on it.

Privacy is a separate question from security

Security is keeping people out. Privacy is what you've agreed to hand over, and how much of it is sitting on the platform's servers.

Read the privacy policy — not all of it, but enough to answer three questions. What do they collect beyond the obvious? Who do they share it with? How long do they keep it after you close the account?

Most policies are long and vague, which is itself informative. But you're looking for whether the answer is stated at all. If the policy doesn't mention retention or third parties, assume your data sits there indefinitely and is shared broadly.

What not to hand over

KYC documents belong inside the platform's own verification flow, not in a chat. If someone messages asking for a photo of your Aadhaar, a selfie with your card, or a screenshot of your banking app, that's collection, not verification.

The same goes for card details outside a payment screen, and any request for your net banking password or PIN. No legitimate operator needs those for anything.

Marketing and settings

Worth a look at your notification and marketing preferences, particularly if you're using a number you also use for personal things. Emails and messages are a data trail, and a steady stream of promotional contacts makes the genuine ones harder to spot.

If you stop using the account, close it properly rather than abandoning it. Withdraw any balance, save your transaction records, request closure in writing through the official site, and ask what happens to your data. Then change any password you reused elsewhere and unsubscribe from the marketing lists.

One thing to know before going further

India's online gaming rules changed in 2025. The Promotion and Regulation of Online Gaming Act banned real-money gaming formats, and financial institutions are barred from processing transactions related to prohibited activity. Existing balances can be withdrawn, but new deposits for banned activity aren't permitted. Rules vary by state.

That's not a security point, but it affects everything above — there's limited value in hardening an account you can't lawfully use. Check your own position.

What actually keeps an account safe

A long unique password. A bookmark you trust instead of a search. An OTP you never repeat to anyone. A phone that's locked and has sensible permissions. Documents that only go into official flows. A closed account when you're done, rather than an abandoned one.

None of that is technical. It's just a set of small decisions made consistently. The scams work because they arrive at the moment you're distracted, not because they're clever — so the defence is a habit rather than vigilance.

And the usual applies: play responsibly, don't put in money you'd miss, and take a break if it stops being enjoyable.