In India, millions of investors hold shares, mutual funds, and other securities in their Demat accounts. While opening a Demat account is easy, keeping it secure is an ongoing responsibility. Cyber threats, data leaks, and account takeover attempts are rising every year. A simple yearly security audit of your Demat settings can protect your hard-earned money from fraud and unauthorized access.
This easy-to-read guide explains the 5 most important things you should check in your Demat and trading account every year. Following this routine takes less than 30 minutes but can save you from major losses.
Why You Need a Yearly Demat Security Audit
- Hackers target Demat accounts because they hold liquid wealth.
- Many investors forget to update details after changing phone numbers or emails.
- Brokers sometimes change security features in updates.
- Early detection of suspicious activity can prevent fraud.
Treat your Demat account like a bank locker — regular checks are essential.
5 Things to Check in Your Demat Settings Yearly
1. Passwords, PINs, and Two-Factor Authentication (2FA)
Strong authentication is your first line of defense.
What to check:
- Change your trading password and login PIN at least once a year.
- Use a strong, unique password (mix of letters, numbers, and symbols).
- Ensure two-factor authentication is enabled — preferably app-based (TOTP) or biometric instead of only SMS OTP.
- Check if your broker supports UPI-based login or fingerprint/face ID.
Action steps:
- Log into your broker app (Zerodha, Groww, Upstox, etc.).
- Go to Profile → Security Settings → Change Password.
- Enable or update 2FA immediately if it’s off.
- Never share OTPs with anyone claiming to be from your broker.
Pro Tip: Use a password manager like Bitwarden or LastPass to generate and store strong passwords.
2. Registered Mobile Number and Email ID
Most frauds happen through compromised contact details.
What to check:
- Verify that your current mobile number and email are correctly registered with your broker and depository (CDSL or NSDL).
- Make sure you are receiving all transaction alerts.
- Remove any old or unused contact details.
Action steps:
- Login → Profile → Personal Details → Update Contact Information.
- Confirm details with CDSL (cdslindia.com) or NSDL (nsdl.co.in) using your 16-digit Demat account number.
- Update immediately if you changed your number recently.
Why it matters: Many scams start with OTPs sent to old numbers that fraudsters may have access to.
3. Nominee Details and Successor Settings
Nomination ensures smooth transfer of assets to your loved ones.
What to check:
- Confirm a nominee is registered (mandatory for Demat accounts now).
- Update nominee if your family situation has changed (marriage, children, etc.).
- Check the percentage allocation if multiple nominees.
Action steps:
- Go to Profile → Nomination → View or Modify.
- Submit fresh nomination form if required (most brokers allow online e-nomination).
- Download and keep a copy of the nomination confirmation.
This small step can save your family from legal hassles later.
4. Linked Bank Accounts and Payment Mandates
Unauthorized bank linkages are a common entry point for fraud.
What to check:
- Review all linked bank accounts — keep only active ones.
- Verify e-mandate (NACH) settings for SIPs or auto-payments.
- Check if any old or unused bank accounts are still linked.
- Ensure only your own bank accounts are added.
Action steps:
- Profile → Bank Accounts → View Linked Banks.
- Delete unnecessary accounts.
- Set daily withdrawal limits if your broker allows it.
- Confirm that UPI and net banking mandates are secure.
5. Login History, Alerts, and Activity Logs
Regularly monitoring access can catch suspicious activity early.
What to check:
- Review recent login history and devices used.
- Check if alerts for every transaction (buy/sell, fund transfer) are enabled.
- Look for any unknown orders, holdings changes, or failed login attempts.
- Verify email and SMS notification preferences.
Action steps:
- Go to Security → Login History or Activity Log.
- Enable all important alerts: transaction SMS, email, WhatsApp, and in-app push.
- Set price alerts and holding value change notifications.
- Report any suspicious login immediately to your broker.
Bonus Security Checks (Beyond the Top 5)
- Data Sharing Permissions: Check if your broker is sharing your data with third parties. Opt-out wherever possible.
- Demat Account Freeze Option: Consider freezing your account when not actively trading (available with CDSL/NSDL).
- Broker App Updates: Always keep your trading app updated for latest security patches.
- Review Holdings Regularly: Download statement (CAS) once a year and match with your records.
- Power of Attorney (PoA): Cancel any old PoA if not needed.
How to Perform Your Yearly Demat Security Audit (Checklist)
- Choose a fixed date every year (e.g., your birthday or 1st January).
- Login from a secure device and network.
- Go through all 5 points above.
- Update everything that needs change.
- Download fresh account statement and CAS (Consolidated Account Statement).
- Note down important helpline numbers of your broker, CDSL, and NSDL.
What to Do If You Find Something Suspicious
- Immediately change passwords and enable 2FA.
- Contact your broker’s customer care.
- File a complaint with SEBI SCORES if needed.
- Report to cyber cell if you suspect fraud.
Benefits of Regular Security Audit
- Peace of mind during market volatility.
- Protection against rising cyber threats in India.
- Faster recovery in case of any issue.
- Better compliance with regulatory requirements.
Conclusion
A yearly security audit of your Demat settings is a small habit that offers big protection. By checking passwords, contact details, nominees, bank linkages, and activity logs every year, you stay one step ahead of fraudsters.
Your Demat account holds your financial future — secure it like one. Don’t wait for a problem to appear. Take 30 minutes today and schedule your next audit for next year.
Stay safe, trade smart, and protect your wealth.
FAQs on Demat Account Security Audit
Q1. How often should I check my Demat account security?
At least once a year, plus whenever you change your phone, email, or move houses.
Q2. Is it necessary to change password every year?
Yes, it is a good security practice, especially for trading accounts.
Q3. What is the easiest way to check nominee details?
Login to your broker app or CDSL/NSDL portal and view nomination status.
Q4. Can someone hack my Demat account even with 2FA?
Risk is very low with app-based 2FA, but never share OTPs.
Q5. Should I freeze my Demat account?
Yes, if you are not trading for long periods. It prevents unauthorized transfers.
Q6. Where can I download my Consolidated Account Statement (CAS)?
From CDSL or NSDL websites using your PAN and Demat details.
Q7. What if I forget my trading password?
Use the “Forgot Password” option. Most brokers allow reset via registered email/mobile.
Q8. Is yearly audit enough for high-value portfolios?
For portfolios above ₹10 lakh, consider checking every 6 months.
Disclaimer: This article is for educational purposes only. Security practices may vary by broker. Always refer to your broker’s official guidelines and consult professionals if needed.