The plain answer
Two-factor authentication means a login needs two proofs from two different categories: something you know, a password or PIN, and something you have or are, an OTP on your phone or your fingerprint. One factor can be stolen; two, from different categories, are far harder to steal at once. Your trading app stacks these with a third layer, the TPIN, which authorises demat debits separately from login. Each layer exists because the others can fail, and together they make a stolen password nearly useless on its own.
The second factor on Indian trading apps is usually an OTP sent to your registered mobile, and increasingly a biometric check on the device itself. The OTP proves possession: the number is yours and only your SIM receives it. The biometric proves presence: the finger or face belongs to you, and the check happens on your device. Both answer the same question, is this actually you, from different directions.
The stack is not just at login. Sensitive actions inside the app, placing certain orders, changing bank details, disabling security settings, trigger their own OTP checks. The TPIN then sits at the final gate, the one where shares actually leave your demat account. The result is a design where a fraudster would need your password, your phone and your TPIN, or your device and your finger, to do real damage.
The layers, one by one
| Layer | What it is | What it protects | Failure it covers |
|---|---|---|---|
| Password or PIN | Something you know | Session entry | Someone else logging in |
| OTP | Something sent to your registered device | New devices and sensitive actions | A stolen or reused password |
| Biometric | Something you are | Fast, observation-resistant login | Shoulder surfing and stolen PINs |
| TPIN | A code for demat debits | Shares leaving your account | A compromised app session |
Read the table column by column and the design intent appears. The password is the weak factor, so it is always paired. The OTP covers the moments a stolen password would be spent. The biometric covers the moments someone watches you type. The TPIN covers the worst case: a fully logged-in session, because even a session that looks like you cannot move shares without a separate code the session does not contain.
The order also matters. You never see the OTP for routine screen taps, and you never see the TPIN for logging in. Each layer appears only at its own gate. When an app asks for a factor outside its usual gate, a TPIN at login, an OTP after a settings page you did not open, that itself is a signal to stop and check what is happening.
Why the OTP exists
A password can be reused, leaked in another site’s breach, or observed over your shoulder. The OTP cannot be reused, because it expires in minutes and lives on your registered device. Apps send OTPs at login from new devices and at sensitive actions, not because they doubt you, but because those are the two moments a stolen password would be spent. The OTP is the layer that converts “someone knows my password” into “someone needs my phone too”, which is the entire point of the second factor.
The expiry is the mechanism. A leaked password stays valid for years; a leaked OTP is valid for minutes and often single-use. When a login attempt from an unknown device triggers an OTP you did not request, that is not an annoyance, it is evidence: someone, somewhere, has your password and is trying it. The OTP check is also the moment most account takeovers die, because the fraudster holds the password but not the phone.
The same logic explains the action-level OTPs. Changing your linked bank account, altering nominee details, disabling alerts: each is a step a takeover would take, so each re-asks the second factor. The question to ask when an unexpected OTP arrives is never “why does the app keep asking”, it is “who triggered this check”.
The delivery channel matters too. OTPs arrive by SMS to your registered mobile, and many apps also send them to the registered email, so both channels carry the same single-use code. That dual routing is deliberate: if the phone is unreachable, the email still delivers, and if either channel is compromised, the code is still useless without the password or the device it was meant for. Keep both channels current, because the OTP is only as reachable as they are.
Where the TPIN fits
The TPIN sits outside the login stack entirely. It authorises demat debits at the depository level: sells of delivery shares, pledges and transfers. The app could be fully logged in and still unable to move shares without the TPIN, which is the design lesson of the 2020 shift from power of attorney: the authorisation for assets leaving your name should never ride on the same credentials as the session.
Before 2020, brokers collected a power of attorney at account opening, a standing authority to debit client demat accounts. SEBI unwound that arrangement: the February 2020 margin circular stopped treating a broker-held POA as margin on client securities, the pledge system went live on 1 August 2020, and in June 2020 SEBI introduced the TPIN as the per-transaction authorisation. Your shares stopped moving on a piece of paper the broker kept, and started moving only when you enter a code at the moment of the debit.
One practical distinction falls out of this design: the TPIN is asked exactly when shares leave the account and nowhere else. If a caller, a message or a screen you did not open asks for the TPIN, a debit is in progress or a scam is in progress, and you should treat it as both until proven otherwise. No genuine broker employee asks for the TPIN, because the broker has no use for a code it cannot see.
Biometric login, honestly
Biometric login uses your fingerprint or face to verify the second factor at the device. The mechanics matter: the biometric template stays inside your phone’s secure hardware, the app asks the operating system to confirm the check, and the broker’s servers receive a confirmation key, never the fingerprint image itself. That is why biometrics cannot leak the way passwords do: there is no reusable secret anywhere to steal.
The honest limits are equally concrete. After a device restart, most phones require the PIN before biometrics work, so the PIN remains the fallback factor. If someone else’s fingerprint is enrolled on your device, a family member’s, a friend’s, the biometric then proves the wrong person, and the convenience decision quietly deleted the security. And a biometric cannot be changed the way a password can, which makes the enrolment decision permanent until you delete it.
Treat biometric login as what it is: the fastest two-factor check available, strong against shoulder surfing and password reuse, tied to the physical device. It does not replace the OTP checks on actions and it does not touch the TPIN. The full stack remains four layers; the biometric simply makes the entry layer both quick and hard to fake.
The everyday quirks are worth naming so they never alarm you. A fingerprint reader may reject a wet finger, and face check may ask for the PIN with a mask or in poor light; both are the device being strict, not the account being attacked. When the phone falls back to asking for the PIN instead of the biometric, that is the fallback factor doing its job, and the correct response is to enter the PIN and carry on, not to call support.
The habits that keep it intact
The layers hold as long as the habits do. The habits are ordinary: a unique password for the trading account that is used nowhere else, OTPs entered only by you and never spoken aloud, biometrics enrolled only from your own finger, and the TPIN treated like an OTP. The single weakest habit is the shared device or the family member’s fingerprint enrolled for convenience, because the stack then verifies the wrong person with full success.
- One password, one site. The trading password should exist nowhere else, because credential dumps from other sites are the standard source of stolen login factors. A password manager makes this habit effortless.
- The registered mobile is the keystone. Every OTP and reset routes to it. Keep the SIM active, never let the number lapse to a stranger, and change it through the broker’s official process if you lose the device.
- Biometrics: your finger only. Every additional enrolment is an additional person the stack will verify. One user, one set of biometrics, no exceptions for family.
- Lock screen always. A biometric login on the trading app is worth little if the phone itself has no lock. The phone lock is the outer wall of the whole stack.
None of these habits require effort beyond the first setup, and all of them fail silently if skipped, because the app cannot tell that your password is also your email password. The security of the stack is decided by the enrolment and password decisions made in the first week, not by the strength of the technology.
One habit sits above the rest because it turns every other habit from effort into default: do the setup once, in one sitting, the day the account opens. Set the unique password, turn on alerts, set the TPIN, enrol your biometrics, and check the device list in a single twenty-minute session. Habit-based security fails through postponement, and the account that is configured completely on day one is the account that stays secure without needing further discipline.
The registered email deserves its own sentence, because it is the keystone behind the keystone. Password resets, device changes and security notices route through it, which means the email account itself needs its own two-factor authentication and its own unique password. A trading account with strong 2FA is still one weak email away from a takeover if the email behind it has none.
The settings checklist
Most of the stack is configured in the first week and never revisited. Spend ten minutes in the app’s settings and confirm each of these, in this order:
- Login alerts. Turn on notifications for every login and every new device. The alert is the earliest signal an attack exists, and it arrives on a channel the fraudster does not control.
- Device list. Review the devices logged into the account and remove every one you do not recognise, and every old phone you no longer own. A forgotten device is an open session.
- Registered mobile and email. Confirm both are current, because every OTP and reset routes to them. Update them through the official process if they are not.
- TPIN set. Set the TPIN before you first need it. A settlement day is the worst possible moment to discover the code was never set.
- Biometric enrolment. Confirm the enrolled fingerprints are yours alone, and that the phone lock screen is on. The enrolment list should read one person: you.
The checklist is deliberately boring, because boring is what the stack is for. Each item closes a specific hole, and all five together mean that a stolen password, a lost phone or a shared device degrades the account’s security by one layer instead of by all of them.
What the layers stop, and what they cannot
The stack stops credential theft cold. A password stolen from another site’s breach opens nothing, because the OTP never arrives at the fraudster’s phone. A password observed over a shoulder opens nothing, because the login still needs the second factor. A session token captured mid-use is worth little, because the actions that matter re-ask for OTPs and the demat debit requires the TPIN. Against every attack that steals a login factor, the stack holds.
What the stack cannot stop is the human layer. If you read an OTP aloud to a caller, enter the TPIN on a screen someone sent you, or install a remote access app and watch a stranger drive your screen, no authentication factor saves you, because you are the one passing every check. That is why the fraud pages on this site exist: the modern attack on a demat account is not a password crack, it is a convincing phone call, and the only defence is the habit of never giving factors away.
Two specific failure paths deserve names. The SIM swap: a fraudster re-issues your number to their SIM, and your OTPs start arriving on their phone, so the registered mobile becomes a liability the moment your number behaves oddly. The shared device: a device other people use accumulates their fingerprints, their logins and their habits on your wall. Both are enrolment and ownership failures, not technology failures, and both are fixed by the habits section above, not by a stronger app.
When an unprompted OTP arrives, the response is a routine, not a panic. Note where the OTP came from, change the trading password immediately, review the device list in the settings, and check for any settings changes you did not make. Do not share the OTP, do not call a number from a message, and do not click a link the message carries. The unprompted OTP is the attack announcing itself; the routine above is what a well-configured account does about it.
What people usually get wrong
Biometric login replaces the need for OTPs
Biometrics secure entry; OTPs secure actions. The layers cover different moments and do not substitute for each other.
The TPIN is just another password
It is a depository-level authorisation for debits, separate from login security, and enforced where the shares actually move.
2FA makes the account unhackable
It makes credential theft far less useful. The remaining path is social engineering, which is why every fraud guide on this site is about the human layer.
My fingerprint gets sent to the broker when I log in
The biometric stays inside your device’s secure hardware. The broker receives a confirmation key, not an image, which is why biometrics cannot leak the way passwords do.
An unexpected OTP is just the app being careful
An OTP you did not trigger is evidence that someone else is attempting the second factor. Treat it as an attack signal and change your password.
Questions people ask
It is stronger against observation and reuse, and weaker in one narrow way: a fingerprint or face check is a convenience factor tied to your device, and it falls back to a PIN after a restart. The strongest arrangement is biometric login plus the OTP checks on sensitive actions, which the trading apps already build in. A stolen password does nothing on a device whose biometrics belong only to you.
Because logging in and authorising are different events. The OTP on orders, settings changes and new devices is the second factor applied to actions, not just sessions, which is what makes a stolen session less valuable. The moments that ask for an OTP are exactly the moments a fraudster would spend a stolen password, so the check lands there.
It is a separate authorisation layer for demat debits, enforced by the depository, not by the app. Login security, action OTPs and the TPIN are three distinct checks, and each one exists because the others can fail. The TPIN was introduced in 2020 to replace the old power of attorney, so that authority for shares leaving your name never rides on the same credentials as the session.
No broker lets you disable the mandatory layers, and that is the correct design. The layers you can weaken are behavioural: reused passwords, shared OTPs and unattended devices. Those are the levers the fraud guides on this site warn about, because the technical stack cannot save an account whose owner hands over the codes.
Contact the broker through its official support channels with your identity documents and get the registered mobile changed before doing anything else, because OTPs and resets route to that number until it changes. Also alert your telecom operator, since a SIM swap is the standard fraudster move to capture your OTPs. Until the number changes, treat every OTP sent to the lost device as compromised.
No. The fingerprint or face data stays inside your device’s secure hardware, and the broker’s system stores only an enrolment key that your device answers. That is why the same biometric can open your phone and your trading app without the broker ever receiving an image of your finger. The design keeps the biometric useless to anyone who does not also hold your device.
Sources
- Securities and Exchange Board of India. “Legal framework — circulars.” Accessed 16 August 2026.
- Upstox. “Open a free Demat account,” account types and KYC. Accessed 16 August 2026.
- Central Depository Services (India) Limited. “Official website — demat account services.” Accessed 16 August 2026.
- National Securities Depository Limited. “Official website — depository services.” Accessed 16 August 2026.