How to Recognise Phishing Emails, SMS and Fake Links

"Your electricity will be disconnected tonight at 9.30 pm. Contact our officer immediately." "Your parcel could not be delivered, update your address here." "Dear customer, your KYC has expired and your account will be blocked." Messages like these arrive by SMS, email and WhatsApp every day. They are called phishing, because the sender is fishing for your passwords, card details or OTPs by dangling bait in front of you.

Phishing works because it borrows the look and tone of organisations we trust. The fix is not to become suspicious of every message, but to know the handful of signals that give a fake away.

The pressure is the first clue

Genuine organisations rarely give you minutes to act. Phishing messages almost always create a deadline or a threat: an account blocked today, a fine that doubles tomorrow, a prize that expires in an hour. The goal is to make you act before you think.

When a message pushes you to hurry, treat that urgency itself as a reason to slow down.

Look closely at the sender

On email, the display name can say anything. What matters is the actual address after the @ sign. A message that claims to be from your bank but comes from a free email service, or from a domain with an extra word or a misspelling, is not from your bank.

On SMS, businesses in India send messages under registered sender names, which appear as short letter codes rather than a regular ten-digit number. A "bank" message from an ordinary mobile number is a strong warning sign. That said, a familiar-looking sender name is not proof on its own, so combine this check with the others below.

Read the link before you tap it

A link is where most phishing does its damage. Before tapping, look at the address carefully:

• Check the main domain, which is the part just before the first single slash. In an address such as bankname.example.com, the real site is example.com, not bankname.
• Watch for lookalike spellings, swapped letters or extra hyphens that imitate a well-known name.
• Be wary of shortened links that hide the real destination.
• Remember that a padlock symbol only means the connection is encrypted. Fake sites can have a padlock too.

On a phone, you can usually long-press a link to see the full address without opening it. On a computer, hover the mouse over it.

Notice what they are asking for

No bank, telecom company or government department will ask you to type your full card number, CVV, UPI PIN, net banking password or OTP into a page you reached through a message. Nor will they ask you to install an app from a link or share your screen. If the "next step" involves any of these, you have your answer.

Attachments deserve the same caution. Files that arrive unexpectedly, especially ones ending in .apk on Android phones, can install software that reads your messages and OTPs.

Other small giveaways

• Generic greetings like "Dear user" or "Dear customer" instead of your name.
• Spelling mistakes, odd grammar or a mix of fonts.
• Logos that look stretched or slightly off.
• A reply-to address that is different from the sender.
• An offer that is far better than anything you expected: free phones, huge cashback, a job that pays for liking videos.

None of these alone proves a message is fake, and careful fraudsters avoid many of them. But the more you see together, the surer you can be.

The safest way to check

If you are unsure whether a message is genuine, do not use anything inside it. Close the message and go to the organisation yourself: open the official app you already use, type the website address you know, or call the number printed on your card or bill. If there really is a problem with your account, you will see it there.

If you have already clicked

Clicking a link is not the end of the world, but act quickly if you went further than that.

• If you entered a password, change it at once on the real website, and change it anywhere else you used the same one.
• If you shared card or bank details, call your bank through its official number and ask them to block the card or account.
• If money was taken, call the National Cyber Crime Helpline on 1930 and file a complaint at cybercrime.gov.in.
• If you installed an app from the link, uninstall it, and consider getting the phone checked or reset.

You can also report suspected fraud messages and calls through the Chakshu facility on the Department of Telecommunications' Sanchar Saathi portal, which helps authorities act against the numbers behind them.

Frequently asked questions

Can I get hacked just by opening a phishing SMS?

Simply reading a text message is generally safe. The risk comes from tapping the link, entering details on the page it opens, or downloading a file it offers.

How do I know if a website is real?

Type the address yourself or use the organisation's official app rather than following a link. Check the domain name carefully, and be suspicious of any page that asks for PINs, OTPs or card CVV numbers.

Should I reply "STOP" or call back the number in a phishing message?

It is better not to. Replying or calling confirms that your number is active and may lead to more attempts. Block the sender and report it instead.

One rule covers most of it

If a message asks you to click, pay or share something urgently, go to the source yourself instead of following the message. That single habit quietly defeats most phishing, however convincing it looks.