Fake Padlock Risk: Is Your Net Banking Safe?

India's top digital certificate authority eMudhra had dangerously weak security keys, allowing anyone to fake a 'secure' website. Google removed their certificate. Here's what this means for your online banking and how to stay safe.

Here's what happened: A security researcher found 8 certificate authorities under eMudhra's global hierarchy had critically weak cryptographic keys — some so simple they could be calculated by anyone.. Google removed eMudhra's root certificate 'emSign ECC Root CA – G3' from Chrome on October 27, triggering full-page security warnings on affected websites.. eMudhra has since withdrawn from the TLS certificate business, but accountability questions from Indian regulators remain publicly unanswered..

What you should do: Check for red security warnings in Chrome before entering any login, OTP, or payment detail — never click 'proceed anyway' on a banking or UPI site.. Verify your bank's URL manually by typing it yourself rather than clicking links in SMS or email, especially if you see any certificate error.. Enable two-factor authentication on all financial accounts so that even a spoofed site cannot access your money without the OTP from your registered device..

A padlock icon only proves a certificate exists — not that the site is genuine. Always check the full domain name, not just the lock symbol, before entering any password or PIN.

For readers weighing their credit and loan options, our personal loan guide and CIBIL score resources put this update in context.