What is Phishing?
Phishing is a cyberattack where criminals impersonate trusted organisations — your bank, government, or delivery company — to steal your login credentials, OTPs, card numbers, or Aadhaar details. In India, phishing is the #1 vector for UPI fraud, bank account takeovers, and identity theft.
Unlike traditional hacking, phishing doesn't break your passwords — it tricks you into handing them over voluntarily, believing you're on a legitimate site.
Types of Phishing Attacks
Six attack patterns that Indian users face most frequently.
Email Phishing
Mass emails impersonating SBI, HDFC, IRCTC, or PayTM. Urgent subject lines like "Your account will be suspended." Links go to fake login pages.
Spear Phishing
Targeted attacks using your name, employer, or account details to appear legitimate. Common against company employees and executives.
Smishing (SMS)
"Your KYC is pending — update within 24 hours." or "Your parcel is held." SMS with short links redirecting to fake banking portals.
Vishing (Voice)
Callers posing as bank officials, TRAI, or CBI agents. They create urgency ("your SIM will be blocked") and extract OTPs verbally.
QRishing
Fake QR codes placed on payment points or sent via WhatsApp claiming to be UPI refunds, cashback, or lottery prizes. Redirect to phishing pages.
Clone Phishing
A legitimate email you received is duplicated with a malicious link replacing the original. Appears to come from the same sender you already trust.
8 Red Flags to Spot Immediately
Domain mismatch: sbi-netbanking-alert.com instead of onlinesbi.sbi. The real brand name is buried or misspelled.
Urgent language: "Your account will be blocked in 2 hours." Legitimate banks never create this kind of artificial urgency.
Brand-new domain: Sites registered less than 30 days ago are extremely high risk. PhishGuard flags these automatically.
HTTP (no padlock): Any banking or payment page without HTTPS is immediately suspicious — never enter credentials.
Asks for OTP by phone/chat: No legitimate bank, PhonePe, or Paytm representative will ever ask you for your OTP.
Shortened URLs: bit.ly, tinyurl links hide the real destination. Always expand and verify before clicking.
Generic greeting: "Dear Customer" instead of your name suggests mass-sent phishing email.
Unexpected attachment: PDF or ZIP files in unsolicited emails — especially from "banks" or "courier services" — often contain malware.
Common Scams in India (2026)
UPI/PhonePe/Google Pay Scams
Fake payment requests disguised as "collect" (you pay, not receive). Fake cashback QR codes. Always verify who is requesting money.
KYC Update Fraud
SMS/WhatsApp claiming your Aadhaar-linked SIM or bank account KYC is expired. Link leads to fake UIDAI or bank portal harvesting PAN and Aadhaar.
Parcel Delivery Scams
Fake India Post or FedEx SMS claiming your parcel is held — pay a small fee to release. The payment page captures card details.
Job Offer Scams
WhatsApp messages offering part-time work (₹3000/day for liking YouTube videos). Victims pay registration fees and then lose access.
PM Kisan / Government Scheme Fraud
Fake government portals for PM-KISAN, PMAY, MNREGA claiming your linked account needs verification. Harvests bank account details.
Safety Best Practices
Paste any suspicious link into PhishGuard before opening. Takes 3 seconds and could save your account.
Even if a hacker has your password, 2FA stops them from logging in. Use Google Authenticator or SMS 2FA on all banking apps.
No bank, TRAI, CBI, or government official will ever call and ask for your OTP, PIN, or CVV. Hang up immediately.
Hover over links (desktop) or long-press (mobile) to see the actual URL. onlinesbi.sbi ≠ sbi-onlinebanking.com.
Call 1930 (National Cyber Crime Helpline) or file at cybercrime.gov.in. Report phishing emails to report@phishing.gov.in.