---
title: "Stock brokers and investment apps (SEBI): your rights and how to..."
description: "Trading apps, demat accounts, investment scams and SEBI SCORES. Plain steps, helplines and templates."
url: "https://dpdpr.in/rights/stock-brokers/"
canonical: "https://dpdpr.in/rights/stock-brokers/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Stock brokers and investment apps (SEBI): your rights and how to complain

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

## What data they hold

- PAN, Aadhaar, bank account and income details (KYC).
- Your holdings, trades and profit and loss.
- Nominee details and phone, email and device logs.

## Your rights under current law

- Complain to the broker first, then on SEBI SCORES. The broker must send an Action Taken Report within 21 calendar days.
- You get two reviews: by the Designated Body (for example the stock exchange) and then by SEBI, each asked for within 15 days of the last reply.
- File on SCORES within one year of the problem. SEBI may reject older complaints.
- For money disputes, SMART ODR offers online conciliation and arbitration.
- Pay registered brokers only through @valid UPI handles or accounts checked on SEBI Check.

## Your DPDP rights once in force

Sections 11 to 14 of the DPDP Act (your rights) and the duties of companies in sections 4 to 10 start on **13 May 2027** (G.S.R. 843(E)). Until then, use the sector rules on this page. After that date you can use both.

From 13 May 2027 you can ask what personal data they hold about you and who they shared it with (section 11), and ask for correction or erasure (section 12). They must stop using data once you withdraw consent, unless a law requires them to keep it. Brokers must also keep records that SEBI rules require, so erasure may be limited.

- Access: a summary of your data and who it was shared with ([section 11](https://dpdpr.in/act/section-11/)).
- Correction, completion, updating and erasure ([section 12](https://dpdpr.in/act/section-12/)).
- Grievance redressal by the company, before going to the Board ([section 13](https://dpdpr.in/act/section-13/)).
- Nominate someone to act after your death or incapacity ([section 14](https://dpdpr.in/act/section-14/)).
- Withdraw consent, as easily as you gave it ([section 6(4)](https://dpdpr.in/act/section-6/)).

## Common problems

- Trades you did not place.
- WhatsApp or Telegram 'tips' groups asking you to pay into private accounts.
- Callers who know your holdings.
- Fake apps that copy real brokers.

## Evidence to keep

- Contract notes and ledger.
- Screenshots of the group, app or messages.
- Payment proof and the UPI ID or account you paid.
- Your complaint to the broker and its ticket number.

See the full [evidence checklist](https://dpdpr.in/rights/evidence-checklist/).

## How to approach, step by step

Go in this order. Start with the company. Move to the next step only when the time limit has passed or the reply is not good enough. If money was lost or you were threatened, go to 1930 or the police first.

### Complain about a broker or investment app: the broker first, then SEBI SCORES

SCORES is SEBI's complaint portal for stock brokers, depository participants, mutual funds, listed companies and other SEBI registered entities. Complain to the broker first. If it does not fix the problem, go to SCORES.

**Keep this ready before you start:**

- Your PAN, name, address, email, mobile number and date of birth. SCORES needs all six.
- Your client ID or demat account number.
- Contract notes, ledger, screenshots of trades and app messages.
- Your earlier complaint to the broker and its reply or ticket number.

1. First write to the broker's grievance desk. Its email and escalation contacts are on its website. Save the ticket number.
2. If there is no answer or the answer is poor, open [scores.sebi.gov.in](https://scores.sebi.gov.in/), or use the SCORES app.
3. Click **Sign in/Sign up**. In the pop up, click **Register** next to **Don't have an account?**
4. Register by fetching your details from the KYC Registration Agency (KRA) database, or fill the registration form yourself.
5. Sign in with your user ID, mobile number or email. Enter the OTP and your password. You will see the **Investor Dashboard**.
6. Click **Lodge a complaint**.
7. Choose the category and sub category, the nature of complaint, and the name of the broker or company.
8. Describe what happened in short sentences: dates, amounts, client ID, and what you want done. Attach your proof.
9. Submit. Save the complaint number.
10. The broker must reply on SCORES with an Action Taken Report within 21 calendar days. The dashboard shows days remaining.
11. Not happy with the reply? Ask for a first review within 15 calendar days. The Designated Body (for example the stock exchange) reviews it within 10 days.
12. Still not happy? Ask for a second review by SEBI within 15 days of that reply.
13. For money disputes you can also go to SMART ODR (smartodr.in) for conciliation and arbitration. Choosing ODR closes the SCORES complaint.
14. Help: SEBI toll free **1800 266 7575** or **1800 22 7575**, 9 AM to 6 PM.

Checked on 1 November 2026 against: [SEBI SCORES: complaint portal (home page with toll free numbers)](https://scores.sebi.gov.in/), [SEBI SCORES 2.0: FAQ (registration, lodging, 21 day timeline, reviews, one year limit)](https://scores.sebi.gov.in/faqs), [SEBI investor website: SMART ODR](https://investor.sebi.gov.in/smart_orr.html), [SMART ODR portal (run by the stock exchanges and depositories)](https://smartodr.in/).

### Check that you are paying a real SEBI registered broker

Many investment scams use WhatsApp or Telegram groups and ask you to pay into a private account. SEBI now gives registered brokers a special UPI handle and a free checking tool.

**Keep this ready before you start:**

- The UPI ID or the bank account number and IFSC you were asked to pay.

1. Look at the UPI ID. Registered brokers and mutual funds use the **@valid** handle with a suffix, such as **.brk** for brokers and **.mf** for mutual funds (for example abc.brk@validhdfc).
2. When you pay a @valid handle, your UPI app shows a thumbs up inside a green triangle. If you do not see it, stop.
3. To check any UPI ID or bank account, open [SEBI Check](https://siportal.sebi.gov.in/intermediary/sebi-check), or SEBI's Saarthi app.
4. Enter the @valid UPI ID, or the bank account number and IFSC. See if it matches a registered entity.
5. If it does not match, do not pay. Report the group or number on Chakshu. If you already paid, call 1930.

Checked on 1 November 2026 against: [SEBI press release 64/2025: @valid UPI handles and SEBI Check are live](https://www.sebi.gov.in/sebi_data/attachdocs/oct-2025/1759322811695.pdf), [SEBI Check: verify a broker's UPI ID or bank account](https://siportal.sebi.gov.in/intermediary/sebi-check).

### Report money lost to fraud: call 1930

1930 is the national cyber crime helpline run with the Ministry of Home Affairs. It links your report to banks and wallets so they can try to stop the money. Call as fast as you can. The sooner the report reaches the bank, the better the chance.

**Keep this ready before you start:**

- Your mobile number.
- Name of the bank, wallet or app the money left from.
- Account number, wallet ID or UPI ID that was debited.
- Transaction ID or 12 digit UTR number for each payment.
- Date and amount of each payment.
- Card number, if a debit or credit card was used.
- Screenshots of the payment and of the chat or SMS.

1. Dial **1930** from any phone.
2. Tell them you want to report a financial cyber fraud.
3. Give each transaction one by one: bank, transaction ID or UTR, date and amount.
4. Write down the acknowledgement number they give you. It also comes by SMS.
5. Save that SMS. Take a screenshot of it.
6. Now file the full complaint on [cybercrime.gov.in](https://cybercrime.gov.in) (steps below). The official cybercrime.gov.in instructions ask you to complete it within 24 hours of the call.
7. Call your bank's official customer care number too, and ask them to block the card, UPI or account. Use the number on your card or passbook.

Checked on 1 November 2026 against: [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx), [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx).

### Report a fraud call, SMS or WhatsApp on Chakshu (Sanchar Saathi)

Chakshu is run by the Department of Telecommunications. Use it for calls or messages that try to cheat you, such as fake KYC, fake police, fake customer care, job or loan offers and sextortion. It is for numbers that tried to cheat you. If you already lost money, call 1930 first.

**Keep this ready before you start:**

- A screenshot of the call log or message. The form asks for one.
- The number or SMS header that contacted you.
- Date and time (within the last 30 days).
- Any phone numbers or links mentioned in the message.
- Your own mobile number, to get an OTP.

1. Open [sancharsaathi.gov.in/sfc](https://sancharsaathi.gov.in/sfc/), or open the **Sanchar Saathi** app (Google Play or App Store).
2. On the website, under **Citizen Centric Services**, choose **Chakshu - Report Suspected Fraud Communication**.
3. Under **Report Suspected Fraud**, click **Proceed**.
4. Choose how it came: call, SMS or WhatsApp.
5. Choose the category. The list includes: KYC and Payment related to Bank / Electricity / Gas / Insurance; Impersonation as Police, CBI, Customs, Aadhaar, RBI; Fake Customer Care Helpline; Online job / lottery / gifts / loan offers; Sextortion; IVR / Robo Calls; Malicious link / website; Investment, Stock Market and Trading; Impersonation as DoT / TRAI; Impersonation as a relative / friend; Any Other Suspected Fraud.
6. Attach the screenshot. The portal may fill some details from the image. Check them.
7. Type the number it came from. For an SMS with a name instead of a number, choose **With header** and type the header.
8. Enter the date and the time in HH:MM AM/PM format.
9. In **complaint details**, write at least 30 characters. Say what they asked for and what they claimed.
10. Add any phone numbers and links that were in the message.
11. Enter the mobile number on which you got the call or message.
12. Type the captcha. Click **Verify Mobile via OTP**. Enter the OTP. Click **Verify OTP**.
13. Tick the declaration. Click **Preview**. Check it. Click **Submit**.
14. Take a screenshot of the thank you message. The Department says it will not send you individual results, for privacy reasons.
15. If it came on WhatsApp, also report the chat inside WhatsApp. The portal asks you to do this.

Checked on 1 November 2026 against: [Chakshu: report suspected fraud or spam (Sanchar Saathi)](https://sancharsaathi.gov.in/sfc/), [Sanchar Saathi portal and FAQ (Department of Telecommunications)](https://sancharsaathi.gov.in/).

## Ready-to-use complaint

Copy, fill the brackets, and send it through the company's official channel. Keep a copy.

To: Grievance Officer, \[broker\] Subject: Complaint about \[unauthorised trades / misuse of my data\], client ID \[ID\] On \[date\] \[describe\]. I did not authorise this. Please reverse it and explain how it happened, and tell me who had access to my account data. If not resolved, I will file on SEBI SCORES. \[Name\], \[PAN last 4\], \[mobile\], \[date\]

## Time limits

- Broker reply on SCORES: 21 calendar days.
- Ask for a review: within 15 days of each reply.
- File on SCORES: within one year.
- Fraud: call 1930 at once.

## If this happened to you

- [\*\*Someone called with personal details I never shared with them\*\*A caller knew your name, address, purchases or family details, and named a company.](https://dpdpr.in/rights/scenarios/caller-knew-my-details/)
- [\*\*Someone made a fake profile using my name or photos\*\*An account impersonates you or uses your photos.](https://dpdpr.in/rights/scenarios/fake-social-account/)
- [\*\*A customer care number turned out fake, or a real agent misused my data\*\*A helpline number you found online led to a scammer, or a real support agent misused your details.](https://dpdpr.in/rights/scenarios/fake-customer-care/)
- [\*\*Stock tip callers know I just opened a demat account\*\*Soon after opening a demat account, callers offer tips or advisory plans.](https://dpdpr.in/rights/scenarios/demat-tip-calls/)
- [\*\*I was added to a WhatsApp investment group and lost money\*\*An 'expert' group showed profits on an app, and you cannot withdraw.](https://dpdpr.in/rights/scenarios/whatsapp-investment-group/)

## Official sources

- [SEBI SCORES: complaint portal (home page with toll free numbers)](https://scores.sebi.gov.in/)
- [SEBI SCORES 2.0: FAQ (registration, lodging, 21 day timeline, reviews, one year limit)](https://scores.sebi.gov.in/faqs)
- [SEBI investor website: SMART ODR](https://investor.sebi.gov.in/smart_orr.html)
- [SEBI press release 64/2025: @valid UPI handles and SEBI Check are live](https://www.sebi.gov.in/sebi_data/attachdocs/oct-2025/1759322811695.pdf)
- [Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)](https://www.meity.gov.in/static/uploads/2024/02/Digital-Personal-Data-Protection-Act-2023.pdf)
- [G.S.R. 843(E): start dates for the Act](https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf)