“Your KYC has expired. Update now or your account will be blocked.”
“Your electricity will be disconnected tonight at 9:30 PM.”
“Your parcel is held at customs. Pay ₹49 to release it.”
Most of us have received at least one message like this. Some are easy to spot. Others look almost exactly like a real bank, courier or government notice.
Phishing scams work because they don’t need to hack your phone. They only need to convince you to click, share or pay.
This guide explains how phishing scams work, the warning signs to look for and exactly what to do if you’ve already clicked.
Quick Take
Most phishing scams share the same pattern:
- They create urgency or fear
- They ask for an OTP, PIN, password or payment
- They push you to click a link or install an app
- They pretend to be someone you trust
The simplest rule: never act on the message itself. Open the official app or website yourself and check there.
If you’ve lost money, call 1930 immediately.
Table of Contents
What Are Phishing Scams?
Phishing scams are attempts to trick you into revealing sensitive information or sending money by pretending to be a trusted organization or person.
They arrive through many channels:
- Email: fake bank alerts, invoices or password-reset messages
- SMS: often called smishing, with short links and urgent warnings
- Phone calls: often called vishing, from fake bank staff, police or customer care
- WhatsApp and social media: fake job offers, investment groups or messages from “friends” in trouble
- QR codes: codes that lead to fake payment pages
The channel changes. The trick stays the same.
Common Phishing Scams in India
These are some of the patterns Indian users see most often:
- KYC or PAN update requests with a link
- Electricity bill disconnection warnings
- Courier or customs fees for a parcel you didn’t order
- Income tax or other “refund” messages
- Part-time job offers paying for likes, reviews or simple tasks
- Investment or trading groups promising guaranteed returns
- Fake customer care numbers for banks, airlines and delivery apps
- Calls claiming you’re under “digital arrest” by police or a government agency
Government portals such as Sanchar Saathi specifically list impersonation of agencies, KYC fraud, fake helplines and job or lottery offers among the fraud communications citizens can report.
10 Warning Signs of Phishing Scams
You don’t need technical knowledge to spot most phishing scams. Look for these signs.
1. Urgency or threats
“Act within 2 hours.” “Your account will be suspended today.” Pressure is designed to stop you from thinking. The FTC lists false urgency as one of the most common red flags.
2. Requests for an OTP, PIN or password
Banks and legitimate services will not ask you to share an OTP, UPI PIN, CVV or password over a call, SMS or chat. Anyone who asks is a red flag.
3. Suspicious links and look-alike addresses
Check the sender and the link carefully. Scammers use addresses that look close to the real thing, with extra words, misspellings or unusual domains. Shortened links hide where they really go.
4. Unexpected attachments or APK files
Be very careful with attachments you weren’t expecting, especially files ending in .apk on Android. Installing an unknown app can give scammers access to your messages and OTPs.
5. Offers that are too good to be true
Free gifts, lottery wins, government refunds you never applied for or guaranteed investment returns are classic bait.
6. Generic greetings and odd language
“Dear Customer” instead of your name, awkward phrasing or strange formatting can be clues. But don’t rely on this alone. AI tools now help scammers write cleaner, more convincing messages.
7. Pressure to move to another app or call a number
A message asking you to continue on WhatsApp, Telegram or a phone number it provides is trying to take you away from official channels.
8. UPI collect requests and “receive money” QR codes
You never need to enter your UPI PIN to receive money. If a request asks for your PIN, it’s asking you to send money, not receive it.
9. Fake customer care numbers
Scammers publish fake helpline numbers online. Always take support numbers from the official app, website or the back of your card, not from a random search result or social media comment.
10. Calls claiming to be police or a government agency
In “digital arrest” scams, callers claim you’re involved in a crime and must stay on a video call and pay to clear your name. Legitimate police and government agencies do not arrest people over video calls or ask for money to settle a case. Hang up.
How to Protect Yourself From Phishing Scams
A few habits block most phishing scams before they start:
- Open your bank, UPI or delivery app directly instead of tapping links in messages
- Turn on two-factor authentication and use passkeys where available
- Use a password manager so each account has a unique password
- Keep your phone, browser and apps updated
- Install apps only from the Play Store or App Store
- Lock your SIM with a PIN and set up alerts for every bank transaction
- Talk to older family members about these scams; they’re often targeted
Our guide on how to protect your online privacy explains passwords, passkeys and two-factor authentication step by step.
What to Do If You Clicked a Phishing Link
Act quickly. The faster you respond, the more you can limit the damage.
- Stop. Don’t enter any more details and close the page.
- If you shared banking or card details, call your bank’s official helpline immediately and block the card or UPI access.
- If you lost money, call the national cybercrime helpline 1930 as soon as possible and file a complaint at cybercrime.gov.in.
- Change passwords for the affected account and your email, starting from a device you trust.
- If you installed an app, uninstall it, run a security scan and consider resetting the device after backing up.
- Report the message through Chakshu on Sanchar Saathi, even if you didn’t lose money.
Reporting quickly matters. Speed can make a real difference in whether a fraudulent transaction can be stopped.
Aadyanix Verdict: Beating Phishing Scams
Phishing scams are getting more convincing, especially with AI-written messages and cloned voices.
But the defence hasn’t changed much.
Slow down. Don’t trust the link, number or app a message gives you. Go to the official source yourself. And never share an OTP or UPI PIN with anyone.
If you remember only one thing from this guide, make it this: urgency is the scammer’s favourite tool. The moment a message pressures you, that’s your signal to stop.
Phishing Scams: Frequently Asked Questions
What is the most common type of phishing in India?
SMS and WhatsApp messages impersonating banks, KYC updates, electricity boards, courier companies and job offers are among the most common patterns.
Can I get hacked just by opening a phishing message?
Opening a message is usually low-risk on an updated phone. The danger comes from clicking links, installing apps, opening attachments or sharing details.
Will my bank ever ask for my OTP?
No. Legitimate banks do not ask customers to share OTPs, UPI PINs, CVVs or passwords.
Where do I report phishing scams in India?
Report suspected fraud messages and calls through Chakshu on Sanchar Saathi. If you’ve lost money, call 1930 and file a complaint on the National Cyber Crime Reporting Portal.
How do I check if a link is safe?
Don’t tap it. Type the official website address yourself or use the official app. If you must check, long-press the link to preview the full address without opening it.
