Every day, millions of Indians receive messages that look like they come from their bank, a delivery company or a government office, but are actually traps set by criminals. Phishing, the art of tricking people into revealing passwords, OTPs and bank details, is the most common cyber fraud in the country, and its variants keep evolving. Understanding how these scams work is the single best defence, because every one of them depends on a moment of misplaced trust. This guide explains the mechanics of phishing, the frauds targeting Indians most, and how to stay safe.

How a phishing scam works

Every phishing attack follows the same psychology, dressed in different costumes. The criminal creates urgency: your account will be blocked, your parcel is held, you have won a prize that expires today. The message impersonates a trusted sender, a bank, a courier company, a government department, using copied logos and familiar language. It directs you to act now: click a link, call a number, download an app or share an OTP. The link leads to a fake website that harvests your login or card details, or the call connects to a fraudster who talks you into transferring money or installing remote-access software. The entire attack exploits one vulnerability that no software patch can fix: human trust under pressure.

The frauds targeting Indians most

Several variants dominate Indian cybercrime reports.

• Bank KYC scams: messages claiming your account will be frozen unless you update KYC via a link or app, leading to stolen credentials.
• UPI collect-request fraud: fraudsters on marketplaces send collect requests that look like incoming payments but actually debit your account when approved.
• Fake customer care numbers: scammers plant fake helpline numbers on search results; calling them leads to remote-access apps and drained accounts.
• Parcel and customs scams: SMS about a held package with a small fee to release it, harvesting card details.
• Job and task scams: Telegram and WhatsApp offers of easy money for likes and tasks, which escalate into demands for deposits that vanish.
• Government scheme frauds: fake PM schemes and subsidies that collect personal data and advance fees.

The National Cyber Crime Reporting Portal consistently shows financial fraud as the largest category, with phishing as its engine.

How to spot a phishing attempt

Train yourself to check these signals before acting. Is the sender’s address or number slightly off, a free email domain or an unknown international number? Does the message manufacture urgency or threaten consequences? Are there spelling errors, odd phrasing or mismatched branding? Does it ask for OTPs, passwords or remote access, things legitimate organisations never request this way? Hover over links, without clicking, to see the real destination; lookalike domains like sbi-secure-login.com are a giveaway. And independently verify: if your bank supposedly messaged you, open the official app or call the number on your card, never the number in the message.

What to do if you clicked or shared

Speed matters enormously after a mistake. If you entered card or bank details, call your bank immediately to block the card and freeze transactions. If you shared UPI credentials, disable UPI in your banking app. If you installed a remote-access app, uninstall it, disconnect from the internet and run a security scan. Change passwords for affected accounts from a clean device, and enable two-factor authentication everywhere. Report the fraud on the National Cyber Crime portal at cybercrime.gov.in or the 1930 helpline within the golden hours; quick reporting is what enables banks to freeze fraudulent transfers. Save all evidence: screenshots, numbers, transaction IDs.

Building long-term immunity

Individual vigilance plus a few structural habits make you a hard target. Use a password manager so every account has a unique password; phishing then compromises at most one account. Enable two-factor authentication everywhere, preferably app-based rather than SMS. Keep a healthy scepticism toward unsolicited contact about money, prizes or problems, regardless of how official it looks. Teach these habits to elderly family members, who are disproportionately targeted. And spread the word when you spot a new scam variant; collective awareness is the only patch for the human vulnerability.

FAQs

Can phishing happen on phone calls too? Yes, that is vishing, voice phishing. Treat unexpected calls about money or accounts with the same suspicion as suspicious links.

Are SMS links from banks ever genuine? Banks do send SMS with links, but the safe habit is to never click them; open the official app or website yourself instead.

What is the 1930 helpline? India’s national cyber fraud helpline. Calling quickly after financial fraud gives authorities the best chance of freezing the stolen money.

Phishing works because it attacks trust, not technology. The defence is equally human: pause, verify through independent channels, and never let urgency override judgement. A thirty-second pause defeats most scams ever devised.

Compiled by the Khabar 24h Editorial Desk from publicly available sources.