EPFO members are being urged to stay cautious while accessing provident fund services online as fraudsters increasingly use fake links, phishing messages and impersonation attempts to steal personal and financial information.

The Employees’ Provident Fund Organisation (EPFO) has warned members to verify links before clicking on them and to rely on official channels for PF-related services. The advisory is particularly important because several EPFO facilities—from checking balances and updating information to submitting certain claims—can now be accessed digitally.

While online access has made PF services more convenient, it has also given cybercriminals another opportunity to target users through convincing messages, websites and calls.

A moment of carelessness, such as entering an OTP or banking information on a fraudulent page, could expose sensitive data and potentially put financial accounts at risk.

Here are the key precautions PF members should follow.

EPFO Warns Members About Fake Links and Websites

One of the easiest ways for scammers to deceive users is to create a website that looks similar to an official government portal.

Fraudsters may send links through SMS, WhatsApp, email or social media and claim that immediate action is required to activate a UAN, complete KYC, release a PF payment, process a withdrawal or resolve an account problem.

The message may deliberately create urgency so that the recipient clicks without checking where the link actually leads.

EPFO has advised members to carefully verify a link before opening it and use its official portal for online services.

Users should therefore avoid accessing their PF account through links received unexpectedly from unknown or unverified sources.

EPFO Will Not Ask for Your OTP Over a Call

An OTP is one of the most sensitive pieces of information used to authenticate digital transactions and account-related actions.

PF members should remember that EPFO does not ask them to disclose their OTP over a phone call.

Similarly, members should be suspicious of messages on WhatsApp, SMS or email that request an OTP while claiming to be associated with EPFO.

An OTP should only be entered by the user on the genuine platform when they themselves initiate a legitimate process.

If someone calls claiming to be an EPFO representative and asks you to read out an OTP, the safest response is to end the conversation without sharing anything.

Never Disclose Passwords or Banking Information

Login credentials and banking details should also remain confidential.

According to the warning, EPFO does not seek a member's login password or sensitive banking information through unsolicited calls or messages.

Fraudsters, however, may pose as officials and claim that bank details are required to process a pending PF claim, pension payment, KYC verification or refund.

Such requests should be treated with extreme caution.

A genuine-looking profile picture, logo or caller name is not sufficient proof that the person contacting you represents EPFO.

Keep Your UAN and Personal Documents Secure

Your Universal Account Number (UAN) is an important identifier connected with your provident fund account. It should not be casually disclosed to unknown individuals.

The same caution applies to other personal information, including:

• Aadhaar details
• PAN information
• Bank account details
• Login passwords
• OTPs and authentication codes
• Debit or credit card information

Scammers can combine multiple pieces of personal data to impersonate a victim or attempt unauthorized account-related activities.

Avoid uploading or entering these details on websites reached through suspicious messages, advertisements or social media posts.

How to Spot a Fake EPFO Website or Link

Phishing websites can sometimes look almost identical to genuine pages, making it difficult to identify fraud at first glance.

Before entering any information, carefully inspect the website address.

A fraudulent website may use a slightly misspelled name, additional characters, unusual domain extensions or other subtle changes designed to resemble the legitimate EPFO portal.

For instance, a scammer may alter just one character in a familiar name and rely on users overlooking the difference.

Instead of opening EPFO services through links sent in messages, it is safer to navigate directly to the official EPFO website or use verified government applications and services.

Be Suspicious of Messages Creating Unnecessary Urgency

Cyber scams frequently rely on fear or urgency.

A fraudulent message might claim that your PF account will be blocked, your UAN will be deactivated, your KYC has expired or your pension payment will be stopped unless you immediately click a link.

Other scams may promise an unexpected PF refund, bonus, pension increase or instant withdrawal.

Do not act simply because a message says there is a deadline.

Verify the information independently through official EPFO channels before taking any action.

Use a Strong Password for Your PF Account

Members should also maintain good password hygiene.

Choose a strong password that is difficult for another person to guess and avoid using the same password across multiple online accounts. A compromised password from one service can put other accounts at risk if credentials have been reused.

Never save or share account passwords through unsecured messages.

If you believe your EPFO credentials may have been exposed, change the password through the legitimate portal rather than following a password-reset link received from an unknown sender.

What Should You Do If You Receive a Suspicious EPFO Message?

If you receive an unexpected call, SMS, WhatsApp message or email claiming to be from EPFO, do not immediately respond.

First verify whether the communication is genuine.

Avoid clicking attached links, downloading unknown files or sharing personal information. If a suspicious website or fraudulent communication is detected, it should be reported through appropriate official channels.

Users who believe they have already disclosed sensitive banking information should contact their bank promptly and take appropriate steps to secure their accounts.

Simple Rules Can Help Keep Your PF Account Safer

Digital EPFO services have made managing provident fund accounts considerably easier, but convenience should not replace caution.

The most important rule is simple: never disclose OTPs, passwords or sensitive financial details to someone who contacts you unexpectedly, even if that person claims to represent EPFO.

Use only verified EPFO channels, carefully examine website addresses and avoid unknown links received through SMS, email, WhatsApp or social media.

A few seconds spent checking a website or message can help prevent personal information, PF credentials and banking details from falling into the wrong hands.