Phishing scams are among the most common forms of online fraud. A scammer may send an email, SMS, WhatsApp message or social media message that looks like it came from a genuine bank, government department, delivery company or online service.
The goal is usually to trick you into clicking a malicious link, revealing sensitive information or transferring money.
Learning how to identify a fake link or email can help protect your personal information, bank accounts and digital identity.
What Is Phishing?
Phishing is a type of cyber fraud in which criminals impersonate a trusted person or organisation to deceive victims.
A phishing message may ask you to:
- Verify your bank account
- Update KYC details
- Claim a refund or reward
- Pay a pending bill
- Confirm a delivery
- Reset your password
- Click a link to avoid account suspension
The link may lead to a fake website designed to steal your login credentials, card details, passwords or other sensitive information.
Phishing can occur through email, SMS, social media, messaging apps and even phone calls.
How to Identify a Phishing Email or Message
1. Check the Sender’s Email Address
Do not rely only on the name displayed in an email.
A message may appear to come from a familiar company but use a suspicious email address. Look carefully at the complete sender address and domain.
For example, an address using unusual spellings, extra characters or unrelated domains should raise suspicion.
2. Look Carefully at the Link
A fake link may look genuine at first glance.
Before clicking, hover over the link on a computer to preview the actual destination. On a mobile device, be cautious about tapping shortened or unfamiliar links.
Watch for:
- Misspelled domain names
- Unusual subdomains
- Random letters or numbers
- Suspicious URL extensions
- Domains unrelated to the organisation
- Shortened URLs from unknown sources
Important: A website using HTTPS does not automatically mean it is legitimate. Scammers can also use HTTPS on fraudulent websites.
3. Beware of Urgent Threats
Phishing messages often create a sense of panic.
Examples include:
“Your account will be blocked today.”
“Your KYC will expire within 30 minutes.”
“Click immediately to avoid legal action.”
Legitimate organisations may send reminders, but unexpected messages demanding immediate action should be independently verified.
4. Be Suspicious of Unexpected Attachments
Do not open unexpected email attachments, especially executable files or documents from unknown senders.
A malicious attachment can potentially install malware or redirect you to a fraudulent website.
5. Watch for Requests for Sensitive Information
Be extremely cautious if an unexpected message asks for:
- Passwords
- OTPs
- UPI PINs
- ATM PINs
- Credit/debit card details
- CVV numbers
- Internet banking credentials
Never share your OTP or UPI PIN with someone simply because they claim to be a bank employee or government official.
Common Phishing Scams in India
Phishing scams may target victims through different approaches, including:
Bank and KYC Scams
The victim receives a message claiming that their bank account or KYC needs immediate verification.
Delivery Scams
A fake courier or delivery message claims that a parcel cannot be delivered until the recipient pays a small fee.
Government Impersonation
Scammers may impersonate government officials and send fake notices or payment requests.
Job and Investment Scams
Victims may receive attractive job offers or investment opportunities containing links to fraudulent websites.
Account Verification Scams
A message claims that a social media, email or shopping account will be suspended unless the recipient clicks a verification link.
How to Check Whether a Link Is Genuine
Before clicking an unfamiliar link:
- Check the sender carefully.
- Hover over the link if using a computer.
- Look for spelling mistakes in the domain.
- Avoid shortened or suspicious URLs.
- Do not rely solely on logos or website design.
- Open the organisation’s official website separately instead of using the message link.
- Contact the organisation using a phone number or email address obtained from its official website.
Never use the contact details provided in a suspicious message to verify the message.
What to Do If You Clicked a Phishing Link
Do not panic. Your next steps depend on what happened after clicking.
If you entered a password, change it immediately through the legitimate website or app. If you provided banking information or money was transferred, contact your bank immediately.
You should also:
- Enable two-factor authentication where available.
- Monitor bank and card transactions.
- Disconnect a compromised device from the internet if malware is suspected.
- Preserve screenshots, emails, phone numbers and other evidence.
- Report financial cyber fraud immediately through 1930.
- File a complaint through the National Cyber Crime Reporting Portal at cybercrime.gov.in.
The Government of India’s cybercrime reporting system allows citizens to report cybercrime, including online financial fraud. (cybercrime.gov.in)
Is Phishing a Cybercrime in India?
Phishing can involve several unlawful activities depending on the circumstances. A case may involve offences relating to cheating, impersonation, identity-related misuse, unauthorised access or other cyber offences.
The applicable legal provisions depend on how the scam was carried out and the specific facts of the case. The Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023 (BNS) may be relevant depending on the conduct involved.
Victims should preserve digital evidence and report suspected cybercrime to the appropriate authorities.
How to Stay Safe From Phishing
Follow these basic precautions:
- Never click unexpected links.
- Verify messages independently.
- Use strong, unique passwords.
- Enable two-factor authentication.
- Keep your phone, browser and computer updated.
- Use reputable security software.
- Never share OTPs, passwords or UPI PINs.
- Avoid conducting sensitive transactions through public Wi-Fi.
- Check website addresses before entering personal information.
Final Takeaway
Phishing scams work by making fake messages and websites appear trustworthy. Pause before clicking, verify the sender and check the actual website address.
If you accidentally disclose sensitive information or lose money, act quickly by contacting your bank or service provider and reporting the incident through the appropriate cybercrime channels.
Remember: A message that creates panic and demands immediate action deserves extra scrutiny.
Disclaimer: This article is for general legal and educational information only and does not constitute legal advice. Cybercrime laws and reporting procedures may change, so verify the latest information through official government sources.
