Fake Links, Calls and Messages: Recognising Phishing Attacks

Phishing scams in India are attempts to trick you into handing over OTPs, passwords, card details or UPI PINs by pretending to be a bank, a government office or a delivery company. They arrive as emails, SMS texts, WhatsApp messages and phone calls. If you have already shared something, call your bank on its official number straight away and report the fraud on the cybercrime helpline 1930.

What are phishing scams in India and how do they work?

Phishing is fraud in which a criminal impersonates a trusted sender so that you give up sensitive information or approve a payment yourself. The scammer does not need to break into your bank. They only need you to open the door, usually by tapping a link, reading out an OTP or installing an app.

Most phishing scams in India follow the same four steps. First, the scammer makes contact through a channel you already use. Second, the message creates pressure: your account will be blocked, your card is about to be charged, a parcel is stuck, a refund is waiting. Third, you are pushed to act inside a few minutes, before you can think or ask anyone. Fourth, you share a secret (an OTP, PIN or password) or approve a request, and money leaves your account.

The Indian government runs the Indian Computer Emergency Response Team (CERT-In), which publishes guidance on phishing and other cyber incidents. The National Payments Corporation of India (NPCI) runs UPI and other payment rails, so it is the body behind the PIN approvals that scammers try to obtain.

What is the difference between phishing, smishing and vishing?

The three terms describe the same fraud through different channels. Phishing usually means email or a fake website. Smishing means SMS or messaging apps, including WhatsApp. Vishing means a voice call where the caller poses as a bank officer, a courier or a government official.

Type	Channel	Typical hook	What the scammer wants
Phishing	Email, fake website	Account suspension notice, fake invoice	Login details, card number
Smishing	SMS, WhatsApp, Telegram	KYC expiry, pending refund, parcel fee	You to tap a link and enter details
Vishing	Phone call	Card blocked, suspicious transaction, officer call	OTP, PIN or app installation
QR and collect request scams	UPI app, marketplace chat	Receive a refund by scanning a code	You to approve a payment out
Fake app scams	Link or file sent in chat	Update your bank app, claim a reward	Permission to read your SMS and screen

What do common phishing and smishing messages look like in India?

Scam messages copy the situations Indians actually face every week: a KYC deadline, an electricity bill, a courier delivery, a credit card limit offer, an income tax refund. The message looks routine, which is why careful people fall for it too.

• The KYC expiry message. A text says your account will be frozen today unless you update KYC through a link. The link opens a copy of your bank page. KYC (know your customer) is a genuine requirement, but legitimate updates do not need you to enter an OTP on a page opened from an SMS.
• The card block call. A caller says your credit card has a suspicious charge and asks you to read out the number on the back and the OTP to cancel it. Banks do not need your OTP to protect you. The OTP is what authorises the charge.
• The refund or collect request. A buyer or a delivery agent says they will send money, then sends a collect request or a QR code. Receiving money never requires you to enter your UPI PIN. Entering the PIN sends money out.
• The fake customer care number. You search for a bank helpline during a problem and call a number from a search result or social media post. The person who answers is a scammer who asks you to install a screen sharing app.
• The reward points or tax refund link. A message claims you have points expiring today or a refund pending, and the link asks for card details.
• The loan or debt relief offer. A caller offers to waive your credit card dues or approve an instant loan after you pay a fee upfront or share your documents.

What are the warning signs of a phishing message or call?

A warning sign is any feature that real banks and government offices do not use. If a message shows two or more of the signs below, treat it as a scam until you have called the institution on a number you found yourself.

Warning sign	What it looks like	What a genuine sender does instead
Urgency	Act in 30 minutes or your account is blocked	Gives notice through several channels and does not demand instant action
Request for a secret	Asks for OTP, PIN, CVV or password	Never asks for these, including on a call
Odd link	Shortened link or a domain that is slightly misspelled	Points you to the official app or website you already use
Unknown number	Mobile number or a number with no clear sender name	Sends from a registered sender name that you can match against earlier messages
Apps from outside the store	Asks you to install a file or remote access tool	Uses the official app stores only
Upfront fee	Pay a small amount to release a refund, loan or waiver	Deducts charges as disclosed in a written agreement
Secrecy	Do not tell your family or the bank	Encourages you to ask questions

One habit catches most of these. Before you act on any message about money, close it and open your bank app or type the bank address yourself. If the problem is real, you will see it there.

How do fake links and cloned websites steal your details?

A fake link takes you to a copy of a real login page. You type your user ID, password and OTP into the copy, and the scammer uses the same details on the real site within seconds. The page can look identical because it is built from the real one.

You can reduce the risk with a few practical habits. Type the bank address yourself or use the bank app. Look at the full address before you tap, because scammers register names that differ by one letter or add words such as secure or update. Do not log in from a link in an SMS or chat. Treat a link from an unknown number as untrusted even if the message uses your real name.

What happens if you install a file or app sent in a chat?

A file sent in chat, often named like a bank update, a challan or a wedding invitation, can be a malicious app. Once installed, it may read your SMS messages, including OTPs, and let the scammer see your screen. Remove apps you do not recognise, install apps only from official stores, and call your bank immediately if you installed something after a suspicious message.

What is the difference between safe and unsafe ways to respond?

Your response in the first few minutes decides how much you can limit. The table compares three common reactions after you realise you may have shared details.

Your response	What usually follows	Risk to your money
Wait to see if anything happens	The scammer drains the account or maxes out the card while you wait	Highest, losses can grow with every minute
Call the number in the message or the caller back	You speak to the scammer again, who asks for more details	High, you may share a second secret
Call the bank on its official number, block the card or account, then report	The bank can act on the account and you have a record of the report	Lowest, the earlier you act the more options you keep

What should you do immediately after a phishing scam in India?

Act in this order and do not stop to feel embarrassed. Fraud works on trained, careful people every day.

1. Call your bank on its official number. Use the number on the back of your card or inside your bank app, and ask them to block the card or freeze online transactions.
2. Report on 1930 and the cybercrime portal. The National Cyber Crime Reporting Portal is where you report financial fraud, and its helpline number is 1930. Report quickly, because speed can matter when a bank is trying to act on a transaction.
3. Change your passwords and UPI PIN. Start with the account the scammer targeted, then your email, since email can reset other accounts.
4. Remove suspicious apps. Uninstall anything you installed from a link or file.
5. Keep evidence. Save screenshots of the message, the number, the link, the transaction messages and the call time. Do not delete the chat.
6. Put your complaint in writing to the bank. Send an email or use the bank app so that the date and time of your report are recorded.

Rules on who bears the loss in an unauthorised transaction depend on the facts, such as how quickly you reported and whether you shared a credential yourself. Ask your bank for its written policy for your account and card, and see the Reserve Bank of India financial education material for the regulator’s own guidance to customers. If the bank does not resolve your complaint, the RBI Complaint Management System is the route to escalate against a regulated entity.

What does a phishing scam on a credit card cost in practice?

A credit card scam leaves you with a bill even though you never made the purchases. The example below is illustrative and uses assumed figures, not a real case or a BillCut rate.

Assume a scammer gets an OTP from you on a call and makes three card transactions: Rs 25,000, Rs 18,500 and Rs 6,500. The total is Rs 25,000 + Rs 18,500 + Rs 6,500 = Rs 50,000. Assume the card charges an illustrative 3.5 percent per month on unpaid balances. Real rates vary by card and bank.

Item	Amount
Fraudulent transaction 1	Rs 25,000
Fraudulent transaction 2	Rs 18,500
Fraudulent transaction 3	Rs 6,500
Total on the statement	Rs 50,000
Illustrative interest for one month at 3.5 percent	Rs 1,750
Balance after one month if nothing is resolved	Rs 51,750

The interest is Rs 50,000 x 3.5 percent = Rs 1,750, so the balance after one month would be Rs 50,000 + Rs 1,750 = Rs 51,750. This is why reporting on the same day matters, and why you should ask the bank in writing how it will treat the disputed amount and any interest on it while it investigates. The treatment depends on the bank and the facts of your case.

If your card balance has grown because of fraud or other pressure, you can see how BillCut converts high interest card debt into structured EMIs and decide whether it suits you.

How can you prevent phishing scams in India before they happen?

Prevention works best when it is a handful of fixed rules rather than a long list. Each rule below removes one of the steps scammers rely on.

• Never share an OTP, PIN, CVV or password with anyone. This includes people claiming to be from your bank, a courier or the police. No genuine caller needs it.
• Save your bank’s official numbers in your phone. Take them from the back of your card or your statement, so you never need to search for a helpline in a crisis.
• Do not tap links in unexpected messages. Open the app or type the address yourself.
• Turn on transaction alerts and card controls. Alerts show a fraud within seconds. Many banks let you switch off online, international or contactless use of a card until you need it.
• Use a strong, separate password for email. Your email can reset your other accounts, so protect it first. Add a second step to the login where it is offered.
• Keep your phone updated and install apps only from official stores. Do not grant screen sharing or SMS permission to an app you do not know.
• Slow down any request that involves a deadline and money. Ending the call costs you nothing. A scammer will push you to stay on the line.

UPI is built so that you approve outgoing payments with a PIN, and that design is why scammers aim at the PIN. If you want to understand what happens when you tap pay, read our guide to how UPI works for everyday payments. For payment rails and mandates, the role of NPCI in Indian fintech explains who runs what.

How do phishing scams affect your credit and your debt?

A scam can reach your credit profile through the loans and card balances it creates. If a scammer takes a loan in your name or runs up a card, unpaid amounts can show up on your credit report if they are not resolved. The explanation of how credit bureaus work in India shows how lenders report and how you can read your own report.

Scammers also target people who are already struggling with debt. Fake debt relief or settlement offers ask for an upfront fee, your Aadhaar and PAN details or a photo of your card. Before you share anything with a company that offers to waive or reduce dues, use the RBI Sachet portal, which lets you look up whether an entity is registered and report illegal lending or money collection.

Who should and should not use this guide, and what are its limits?

This page explains how phishing works and what to do next. It is general information, not legal advice and not a guarantee that you will recover money.

This guide suits you if	You need a different resource if
You received a suspicious SMS, email or call and have not acted yet	Money has already left your account and you need an official case record, so report on 1930 first
You shared an OTP or clicked a link and need the steps in order	Your bank has rejected your complaint and you need to escalate, which is covered by the RBI complaint route linked above
You want rules to protect family members, especially older relatives	You need legal advice on a specific dispute, which a lawyer should provide
Fraud has left you with higher card dues and you want to compare repayment options	You want a promise of recovery or a quick fix, which no guide can give

BillCut is a debt refinancing provider, so it has a commercial interest in the repayment option mentioned in this article. It is one choice among several. You can also speak to your own bank about restructuring or a balance transfer, and compare the total cost of each route before you decide.

How can BillCut help if a scam has left you with card debt?

BillCut is a debt refinancing platform that helps Indian borrowers convert high interest credit card debt into structured, lower interest EMIs. It does not investigate fraud, recover stolen money or replace your bank and the police. Those steps are covered above and should come first.

Where BillCut can be relevant is the aftermath. If a fraudulent or disputed charge has been resolved and you are left with a card balance that keeps attracting interest, a fixed EMI plan can make the repayment predictable, as the worked example above shows how quickly revolving interest adds up. The terms you are offered depend on your profile, so compare the total cost and the tenure against your current card interest before you commit.

Whoever asks you for an OTP, card PIN or CVV, in BillCut’s name or any other, is a scammer. If you are unsure whether a message really came from a company, do not reply and look up its official contact details yourself.

Stay one step ahead of the next message

Scammers rely on speed, fear and routine. You rely on a pause, a saved number and the habit of opening the app yourself. If you reported a scam this week, keep your evidence, follow up with your bank in writing and watch your statements for the next few cycles.

Share the warning signs above with a parent or friend today, because the person who needs them most is often the one not yet targeted.

Frequently Asked Questions