India had over 13 lakh cyber crime cases in 2023. A significant chunk of those — financial fraud, account takeovers, UPI scams — started with a compromised password. And the frustrating part is that most of these attacks work not because hackers are sophisticated, but because people use passwords like "India@123" on their banking apps.
I'm not going to lecture you about password hygiene. I'm going to explain exactly how your accounts actually get compromised, so you understand why certain things matter.
How accounts actually get hacked
The most common method isn't some genius hacker sitting in a dark room typing furiously. It's credential stuffing — attackers take a list of username/password combinations leaked from one hacked website and automatically test those same combinations on hundreds of other websites. If you use the same password on your Zomato account and your bank account, and Zomato gets hacked, your bank is now at risk.
Dictionary attacks are the second most common. Attackers run programs that try thousands of common words, phrases, and known passwords per second. "Password1!", "Qwerty@123", "India@2024" — these get cracked in milliseconds because they're on every dictionary list.
Brute force is what most people imagine hacking looks like, but it only works on short passwords. A 6-character password has about 309 million combinations — sounds like a lot until you realise modern computers test billions of combinations per second. A 12-character password with mixed characters has trillions of combinations and takes effectively forever to crack.
Phishing is different — it doesn't crack your password, it tricks you into giving it up. You get an SMS that looks like it's from HDFC Bank, click the link, land on a fake page that looks identical to the real thing, and enter your credentials. CERT-In consistently rates phishing as India's top cyber threat. Always type bank URLs directly — never click links in SMS or email.
What actually makes a password strong
Length is the most important factor. A 12-character password is not twice as secure as a 6-character password — it's millions of times more secure, because the number of possible combinations grows exponentially with each additional character.
A 6-character all-lowercase password: cracked instantly. An 8-character mixed password: cracked in about 22 minutes. A 12-character mixed password with symbols: estimated thousands of years on modern hardware.
Complexity matters less than people think. "Tr0ub4dor&3" looks complex but is actually weaker than "correct horse battery staple" — because the pattern of letter-to-number substitutions (a→4, e→3, o→0) is well-known to attackers and included in their dictionaries.
The passphrase approach — longer, not harder
Pick three or four completely random, unrelated words and connect them with symbols: Mango!Train#Cloud7. That's 18 characters, easy to remember, and practically impossible to crack. Add a site-specific element to make it unique per account: Mango!Train#Cloud7-HDFC for your HDFC account, Mango!Train#Cloud7-Gmail for Gmail.
This approach gives you strong, unique passwords for every account without needing to remember random strings of characters.
The OTP scam specific to India
No legitimate bank, government office, telecom provider, or any real organisation will ever call you and ask for an OTP. Never. Not once. Anyone who calls asking for your OTP is attempting fraud. This is true even if they know your name, your bank account number, and the last four digits of your card — that information can all be obtained from leaked databases.
SIM swap fraud is related — attackers convince your telecom provider (Jio, Airtel, Vi) to issue them a duplicate SIM with your number, then use SMS OTPs to reset your banking and email passwords. If your phone suddenly loses signal in an area with normal coverage, call your telecom provider immediately.
Two things worth doing today
Enable two-factor authentication on your email, banking apps, and social media accounts. Even if your password is compromised, 2FA stops the attacker. Check haveibeenpwned.com to see if your email address has appeared in any data breaches.
Generate a cryptographically random, strong password with our Password Generator — it runs entirely in your browser, never stores or transmits anything.