# Padlock Safety Card

> Padlock dikhe to bhi ye teen check karo

Free guide by bloopcommits (@bloopcommits) · https://bloopcommits.pages.dev/padlock/

Address bar mein padlock dikhta hai to dil ko tasalli milti hai: "site safe hai". Is guide mein hum dekhte hain ki padlock (HTTPS) asal mein kya batata hai, kya nahi batata, aur password, OTP ya paise dene se pehle kaunse checks karne hain. Jo baatein Chrome team ke blog, APWG ki report, RBI aur cybercrime.gov.in ke pages par likhi hain, wahi se hain. Jo meri apni salah hai, uspe saaf likha hai "meri salah".

## Padlock (HTTPS) kya batata hai

- Chromium Blog (Chrome Security team) ke hisaab se lock icon ka matlab hai ki browser aur site ke beech ka network connection ek secure channel hai: beech mein koi third party use dekh (eavesdrop) ya badal (tamper) nahi sakta.
- Yaani padlock raaste ki suraksha ki baat karta hai: aapka data site tak pahunchte waqt.
- Chrome team khud likhti hai ki lock icon website ki trustworthiness (bharose) ko indicate nahi karta.

## Padlock kya NAHI batata

| Sawaal | Padlock ka jawab |
| --- | --- |
| Site imaandar hai? | Nahi batata. Chrome team: lock icon website ke bharose ki nishani nahi hai. |
| Site phishing to nahi? | Nahi batata. Chrome ke blog ke mutabik lagbhag saari phishing sites HTTPS use karti hain, isliye unpe bhi padlock dikhta hai. |
| Address wahi hai jo mujhe chahiye? | Nahi batata (meri salah: spelling khud check karo, neeche step 1). |
| Site mere password, OTP ya paise ke saath kya karegi? | Padlock iske baare mein kuch nahi kehta: wo sirf raaste ko secure batata hai, site ki niyat ko nahi. |

> **Chrome team ke apne numbers aur faisla (Chromium Blog)**
>
> - Chrome team ki research mein sirf 11% study participants ne lock icon ka sahi matlab samjha. (Ye Chrome team ka number hai, hamara nahi.)
> - Blog ke mutabik nearly all phishing sites HTTPS use karti hain, aur isliye lock icon bhi dikhati hain.
> - Isi galatfehmi ki wajah se Chrome team ne lock icon ki jagah neutral "tune" icon lagane ka elaan kiya (Chrome 117). Blog ke hisaab se tune icon "trustworthy" ka matlab nahi deta, saaf dikhta hai ki isse click karna hai, aur settings jaisa lagta hai.
> - Connection security ki jaankari ke liye lock ab bhi hai, par naye icon ke peeche. Plain HTTP ko Chrome ab bhi insecure batata rahega.

APWG (Anti-Phishing Working Group) ki apni report bhi yehi kehti hai: log sirf SSL dekh kar ye nahi samajh sakte ki site safe hai ya nahi.

## Password, OTP ya paise dene se pehle: teen check

1. URL ki spelling letter by letter padho. Ek akshar bhi idhar udhar ho (jaise neeche ke example mein), to ruk jao. Ye meri salah hai, official rule nahi.
2. Dekho site kya maang rahi hai: password, OTP ya paise? RBI ke hisaab se account details, login ID, password, PIN, UPI PIN, OTP aur card details kisi ke saath share nahi karni chahiye, bank officials ke saath bhi nahi, chahe wo kitne bhi asli lagein. Khud se poocho: ye site ye sab kyun maang rahi hai?
3. Official app kholo, ya official site ka address khud type karke kholo, aur wahan se compare karo. RBI ki salah: bank / NBFC / e-wallet provider ki official website khud kholo, ya branch se baat karo. Message, email ya link se aayi site se nahi.

Ek aur chhoti baat (meri salah): jis site par padlock hi na ho (plain HTTP), use Chrome ab bhi insecure batata hai. Wahan password, OTP ya card details kabhi mat daalo.

## Banaya hua example: ek akshar ka fark

| Address (banaya hua example) | Kya dikhta hai | Kya karein |
| --- | --- | --- |
| meri-bank.example | Spelling sahi hai. | Phir bhi password dene se pehle step 2 aur step 3 karo. |
| meri-bnak.example | "bank" ki jagah "bnak": do akshar ulte. Padlock tab bhi dikh sakta hai. | Ruk jao. Official app kholo ya official address khud type karke kholo. |

Ye dono address banaye hue hain (".example" ending sirf examples ke liye hoti hai). Koi asli bank ya brand nahi.

## Agar kuch daal diya ho

- Turant apne bank ya e-wallet provider ko batao. RBI: agar aisa debit SMS aaye ya aisa OTP aaye jo aapne initiate nahi kiya, to bank ko turant batao aur UPI samet debit ke saare modes block karo.
- Helpline 1930 par report karo. cybercrime.gov.in par likha hai: online financial fraud national cybercrime helpline 1930 par report karo.
- National Cyber Crime Reporting Portal (cybercrime.gov.in) par Financial Fraud ya Other Cyber Crime ki complaint darj ki ja sakti hai. Portal ki "Report Suspect" facility se suspect Website URLs, phone numbers, email-IDs, SMS headers jaise identifiers bhi report kiye ja sakte hain.
- Meri salah: jis password ko aapne daala, wo jahan jahan use kiya ho, wahan badal do.

## Aam galtiyan

- Padlock dekh ke bina soche password ya OTP daal dena.
- Message ya email ke link se bank ya shop ki site kholna, khud app ya site kholne ki jagah.
- Sirf spelling dekhna aur ye bhool jaana ki site kya maang rahi hai (OTP, paise).
- Kuch daal dene ke baad der karna. RBI bhi bank ko "immediately" batane ko kehta hai.

## 5-second safety card

> **Padlock dikhe to bhi ye check karo**
>
> - Padlock = raasta secure. Site imaandar hai, ye nahi.
> - ☐ URL ki spelling letter by letter dekhi?
> - ☐ Site kya maang rahi hai: password / OTP / paise?
> - ☐ Official app ya khud type kiye official address se compare kiya?
> - ☐ Kuch daal diya? Bank ko turant batao + helpline 1930.

Ye guide jaankari ke liye hai. Ye advice hai, guarantee nahi: koi bhi check har phishing site nahi pakad sakta. Shak ho to ruk jao.

## Official sources

- [Chromium Blog: An Update on the Lock Icon (Chrome Security team)](https://blog.chromium.org/search?q=an+update+on+the+lock+icon)
- [APWG: Phishing Activity Trends Reports](https://apwg.org/trendsreports/)
- [RBI: Safe Digital Banking Practices](https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=53185)
- [National Cyber Crime Reporting Portal (helpline 1930)](https://cybercrime.gov.in)

---
More free guides: https://bloopcommits.pages.dev/