Don’t Get Hooked: Why phishing in India needs your attention
Phishing is a simple trick that steals money or data by fooling people. It is mostly social engineering, not complex hacking. Scammers pretend to be banks, payment apps, or government services to win trust. In India, rapid digital adoption and UPI, mobile wallets, and government portals make many targets easy and valuable.
Individuals, small businesses, and customers of digital payment services are all at risk. Quick recognition and prompt reporting can stop losses and help authorities act. This guide shows how to spot phishing, take immediate steps, and report effectively. Knowing the signs and acting fast can protect your money, identity, and community. Report quickly and share warnings with others.
1
What phishing looks like: common types and tactics
Common forms of phishing
Phishing comes in many shapes. Here are the main ones you’ll see in India:
Email phishing: fake bank or service emails with links or attachments.
SMS phishing (smishing): texts that ask you to click a link or share an OTP.
Voice phishing (vishing): callers spoofing bank or government numbers asking for codes.
Malicious websites & cloned apps: look‑alike sites or sideloaded APKs that steal credentials.
Spear‑phishing: personalised attacks aimed at an individual or small group.
Social media scams: bogus giveaways, romance lures, or fake customer‑support DMs.
Typical attacker goals
Attackers usually want a few things that let them monetize access quickly:
Unauthorized fund transfers (UPI collect/scan misuse, SIM swap follow-ups).
Data harvesting (personal details for identity fraud or resale).
Real‑world Indian vectors
Attackers adapt to local systems and apps. Common examples in India:
Fake UPI collect requests or phoney payment links targeting Google Pay, PhonePe, Paytm, BHIM.
Forged bank SMSs or missed‑call alerts that prompt you to “verify” via a link.
Impersonation of government portals (DigiLocker, income tax notices) or courier firms (Delhivery, Blue Dart, Amazon deliveries).
Bogus KYC/payment demands asking for Aadhaar, PAN, or selfies.
A Bengaluru freelancer once received a WhatsApp “payment” link appearing to come from a client’s Google account; sharing the OTP handed scammers access to their wallet.
How attackers combine tech and psychology
Scammers mix simple technical tricks — spoofed sender IDs, look‑alike domains (paytm‑secure[.]in), fake HTTPS badges, cloned apps outside Google Play — with high-pressure psychology:
Greed/curiosity: fake cashback, lottery, or job offers.
These tactics short‑circuit cautious thinking, which is why learning the practical red flags in the next section is essential.
2
Spot the red flags: practical signs a message or call is phishing
A quick, practical checklist
Watch for these immediate warning signs — if several occur together, treat the message or call as suspicious:
Unexpected messages demanding immediate action (pay, verify, or “your account will be locked”).
Sender addresses or SMS sender IDs that don’t match the official domain or brand name.
Mismatched, obfuscated or shortened URLs (tiny links like bit.ly, lookalike domains, or punycode).
Poor grammar, spelling mistakes, or generic salutations (“Dear Customer” instead of your name).
Requests for OTPs, passwords, CVV, or payment authorisation via message, email, or call.
Unexpected attachments, executables, or prompts to install an app or APK.
Callers who pressure you to confirm codes, share UPI PINs, or ask you to change SIM settings.
Communication that contradicts how the institution normally contacts you (e.g., banks rarely ask for OTPs by email).
Quick technical checks you can do right now
These simple tests often reveal scams in seconds:
Hover a link on desktop (Chrome/Edge/Safari) to see the real destination in the status bar.
On mobile, long‑press or tap-and-hold a link to preview the URL; don’t tap without checking.
For shortened links (bit.ly), add a “+” at the end (bit.ly/example+) to see a preview page.
Inspect email headers: in Gmail use “Show original,” in Outlook check “Message Options,” in Apple Mail use “View > Message > Raw Source” to confirm the From domain.
Verify mobile app source: only install banking/UPI apps from Google Play or Apple App Store and check the developer name (e.g., official Google Pay/PhonePe/Paytm listings).
Check for punycode or lookalike characters (example: paytм.com uses a Cyrillic “м” — looks normal but isn’t).
Red flags on calls
The caller insists you share OTPs, UPI PIN, or passwords “to verify.”
They use urgent, scary language and a “we will lose your money” script.
Caller ID may be spoofed; hang up and call the institution using the number on your bank/UPI app or official website.
Use these checks before you act — a few seconds of caution can stop a costly mistake.
3
Immediate steps to take if you suspect a phishing attempt or have been scammed
A short story: Ravi got an SMS saying his bank account was blocked and clicked a link. Within minutes he realised the site asked for his netbanking password. He switched off Wi‑Fi, called his bank, and within an hour the transactions were stopped. Speed mattered. Use the same urgency.
Stop interacting immediately
If it’s a message, don’t reply, don’t call back, and don’t click any more links.
If it’s a call, hang up. Don’t give OTPs, UPI PINs, CVV, or passwords.
If you clicked a link or entered credentials
Disconnect the device from the internet (turn off Wi‑Fi and mobile data) to limit live remote access.
Move to a trusted device (your known-clean phone or PC) before changing passwords or logging in again.
Change passwords for affected accounts immediately; avoid reusing the same password elsewhere.
Contact banks and payment providers right away
Call your bank’s official helpline (number on the back of your card or the bank website) and request temporary blocks on cards/accounts.
Ask the bank to flag or reverse suspicious transactions; mention the exact time and amount.
For UPI, contact the app support (Google Pay/PhonePe/Paytm) and your bank to suspend or reverse unauthorised transfers.
Freeze or revoke authorisations
In UPI apps: remove linked bank accounts or revoke payment mandates/authorisations (Settings → Bank accounts/UPI settings).
In mobile OS settings: revoke suspicious app permissions or uninstall unknown apps; on Android check “Device admin apps” and revoke admin rights before uninstalling.
Secure accounts and devices
Enable two‑factor authentication (use authenticator apps like Google Authenticator or Authy rather than SMS where possible).
Run a malware/antivirus scan on the affected device — examples: Malwarebytes, Avast Mobile Security, Quick Heal — then remove anything flagged.
If you suspect a deep compromise, factory‑reset the device after backing up essential data.
Preserve evidence for reporting
Take screenshots of messages, emails, and transaction alerts.
Note timestamps, sender IDs, phone numbers, and any link URLs (do not interact further).
Save call logs and any OTPs/transaction IDs.
Act fast: early contact with your bank and clear documentation often make the difference in recovering funds. Next, learn where and how to report these incidents in India so authorities and platforms can take action.
4
Where and how to report phishing in India: official and practical channels
When you spot phishing, report fast and through the right channels so banks, platforms and law enforcement can act. Below are the main routes and what to include when you file a complaint.
1) Bank or payment provider — first stop
Use your bank’s official app, web portal or the helpline number on the back of your card. For UPI apps (Google Pay, PhonePe, Paytm) use the in‑app “Help”/“Report” feature or verified support numbers. Prompt contact can freeze accounts and block transfers.
2) Payments authorities and grievance channels
For UPI/payment disputes escalate through the app and your bank; if unresolved, use NPCI’s grievance routes and RBI’s complaint systems (SCORES) or your bank’s nodal/Grievance Redressal Officer. These channels handle reversals and systemic issues.
3) National cybercrime reporting portal
File at India’s Cyber Crime Portal (cybercrime.gov.in) — it accepts phishing, impersonation, and financial fraud complaints and routes them to local cyber cells. Use this when there’s monetary loss or organized fraud.
4) Local police / cyber cell and FIR
If you lost money, contact local police or cyber cell. Ask about e‑FIR options in your state; for financial loss you may need an FIR to push banks for recovery or initiate criminal probes.
5) CERT‑In, hosting providers and domain registrars
Report malicious websites, phishing domains or mass‑mailing campaigns to CERT‑In. Also report the domain to the site’s hosting provider and registrar (use a WHOIS lookup) so the site can be taken down.
6) Email providers, social platforms and app stores
Use the provider’s “Report phishing” in Gmail/Outlook, report fake pages/accounts on Facebook/Instagram/X, and flag cloned or malicious apps to Google Play / Apple App Store to remove listings.
What to provide when reporting
Full message text and screenshots
URLs and email headers (showing Received/Return‑Path)
Timestamps and call logs (incoming numbers)
Transaction IDs, amounts, bank account/UPI IDs involved
Device details, app names, and any OTP/tracking numbers
Your preferred contact info for follow‑up
A clear report with these details speeds action. In the next section we’ll show how to preserve and organise this evidence so complaints are usable and effective.
5
Preserve evidence and follow up: building a usable complaint
Capture and preserve originals
When you spot phishing, keep originals intact. Don’t edit, delete or forward messages in a way that strips metadata.
Save emails in original format (.eml or “Download original”): Gmail > Show original > Download, Outlook > Save as .eml, Thunderbird > Save message.
Take clear full‑screen screenshots that show the entire message, sender, timestamps and any URLs or phone numbers.
Export SMS/call logs: Android apps like “SMS Backup & Restore” or iPhone backups/screenshots (or Settings > Phone > Recents for call details).
Collect supporting financial evidence
A bank will act faster with concrete transaction proof.
Download bank statements or UPI/Paytm transaction receipts as PDFs showing timestamps and transaction IDs.
Note transaction IDs, beneficiary VPA/account numbers, amounts, and exact timestamps.
Keep screenshots of in‑app transaction pages and any confirmation SMS/email.
Record technical and device details
These details help cyber teams trace the source.
From the email headers, note Received:/X‑Originating‑IP lines and paste the full header into your report.
Record device model and OS (Settings > About phone), app name and version (App store or app settings).
Save URLs (don’t click suspicious links again); copy them exactly. If a website is live, use a WHOIS lookup and note hosting provider.
What NOT to do
Small mistakes can ruin evidence.
Do not alter messages, crop screenshots that remove headers or timestamps, or delete call/SMS threads.
Avoid clicking phishing links again. If you must, do so only in a safe sandbox and record the steps.
Recording calls: only do if local law permits; when in doubt, get legal advice before sharing recordings.
Track, escalate and follow up
Treat reporting like a case file.
Always get acknowledgement/reference numbers from banks, NPCI, SCORES or cyber cells and note the contact person.
Follow up within 48–72 hours, then weekly. Many banks acknowledge quickly but reversals or investigations often take 7–30 days or longer.
If unresolved, escalate to the bank’s grievance officer, NPCI/RBI channels, or your local cyber cell. Consider consulting a lawyer to file an FIR or pursue civil recovery and to draft a formal demand with timelines and evidence.
Keep a simple log (date, contact, reference, summary) — persistence plus well‑organized evidence is often what secures reversals or takedowns.
6
Practical prevention: habits, settings and tools to reduce risk
Everyday habits that pay off
Small behaviour changes stop most scams. Use official apps or bookmarks instead of following links in messages. Pause before clicking — treat unexpected requests as suspicious. If a message pressures you, step away and verify by calling the institution using the number on their official website.
Accounts, alerts and transaction controls
Turn on every alert and limit you can.
Enable SMS/email/push alerts for transactions and login attempts.
Set per‑day spending or transaction limits in your bank or UPI app (most banks and Google Pay/PhonePe/Paytm let you change limits).
Disable automatic forwarding of OTPs or SMS in any settings or automation apps.
Passwords and multi‑factor authentication
Make access harder to crack.
Use a reputable password manager (Bitwarden, 1Password, or LastPass) to store unique, strong passwords and generate long passphrases like three random words.
Prefer authenticator apps (Google Authenticator, Microsoft Authenticator, Authy) or hardware keys over SMS‑based MFA wherever supported.
Avoid reusing passwords across financial and email accounts.
Device and app hygiene
Simple settings block many attacks.
Keep OS and apps updated — many patches fix security holes exploited by phishing.
Don’t install apps from unknown sources; on Android, disable “Install unknown apps.”
Check and revoke UPI/banking app authorisations regularly.
Network safety and VPNs
Public Wi‑Fi can expose credentials.
Avoid banking over public Wi‑Fi. If necessary, use a trustworthy VPN (ProtonVPN, NordVPN, ExpressVPN).
Use HTTPS and check the site certificate before entering credentials.
Device‑level protections & backups
Prepare for theft or loss.
Use screen locks (PIN + biometric) and enable remote‑wipe/Find My Device (Google Find My Device, Apple Find My iPhone).
Back up important data securely (encrypted cloud or local backups).
Teach others and set simple rules
Protect household members — especially older relatives — with short rules they can remember.
Never share OTPs or passwords.
Pause, verify via official channels, and don’t rush.
If unsure, ask a tech‑savvy friend or call your bank.
These practical steps reduce exposure and make attacks far less likely — next, we’ll close with how to stay alert and report promptly.
Stay alert and report promptly
Vigilance, quick action and clear reporting are your strongest defenses against phishing. Use the checklists above to verify messages and calls before responding. When in doubt, pause, don’t click, and confirm through official apps or numbers — a few cautious steps can prevent large losses too.
Report suspicious messages promptly via the official Indian channels listed earlier and to your bank or service provider. Preserve evidence and follow submission steps so authorities can act. Share what you learn with family, colleagues and community — informed networks make phishing less effective and keep more people safe everywhere today.
Short and practical article — liked the prevention checklist. The bit about turning on two-factor auth and app permissions was especially useful. Wish more companies enforced stronger 2FA by default though.
Short and practical article — liked the prevention checklist. The bit about turning on two-factor auth and app permissions was especially useful. Wish more companies enforced stronger 2FA by default though.