How to Recognise a Phishing SMS or Email: Seven Warning Signs
10 min read Phishing messages copy banks, courier companies and government departments to steal your login or OTP. These seven signs help you spot them in seconds, plus what to do if you have already clicked. September 17, 2026 08:55 By Disha Varia, Guj Times
Phishing is when a criminal sends a message that looks real, in order to make you click a link, install an app or share a secret such as an OTP. The messages arrive by SMS, email, WhatsApp and even phone calls. They are not always badly written any more, so it helps to know the patterns rather than rely on typing mistakes.
1. It creates urgency or fear
"Your account will be blocked in 24 hours." "Your parcel will be returned." "Pay the pending fine now." Scammers want you to act before you think. A real bank or government department rarely threatens you through a link in an SMS.
2. It asks for an OTP, PIN or password
No genuine organisation asks you to read out an OTP, UPI PIN, card CVV or password. An OTP is meant to be entered only by you, on the official app or website.
3. The link looks almost right
Criminals register addresses like a famous name with an extra word, a hyphen or a different ending. Shortened links hide the real address completely. Do not tap them. If you want to check a claim, open the official app or type the website address yourself.
4. The sender is unusual
An email from a bank that comes from a free email address, or an SMS from a long mobile number instead of a registered sender ID, deserves doubt. Be aware that scammers can also copy sender names, so the sender alone is not proof.
5. It offers something too good to be true
A lottery you never entered, a gift voucher, a refund you did not request or a job that pays a lot for little work. If it sounds too good, it usually is.
6. It asks you to install something
A message that asks you to download an app or an APK file to "complete KYC" or "track a parcel" is a classic trap. Read how to protect yourself in our guide on spotting fake apps.
7. It asks you to keep it secret or stay on a call
Real organisations do not ask you to stay on a video call or hide the matter from your family. If someone does, hang up and talk to a family member before doing anything.
How to check safely
- Do not use the phone number or link in the message. Open the official app or call the number printed on your card or on the official website.
- Look at the full web address before you enter anything, and prefer typing it yourself.
- If you are still unsure, ask someone you trust, or wait. Real problems can usually be checked through the official app.
If you clicked or shared something
- Disconnect from the page and do not enter more details.
- If you shared a password, change it at once, and turn on two-step verification, following the steps in our account guide.
- If a card or bank detail was involved, call your bank right away using its official number.
- Report the fraud on cybercrime.gov.in or call 1930, and keep screenshots of the messages.
Report suspicious messages
You can report suspicious calls and messages through the government's Sanchar Saathi portal, which has an option for it. Reporting helps get the numbers blocked, and protects other people. Learn more about the portal in our guide to checking the SIM cards in your name.
Quick answers
Is an SMS with my correct name and account number genuine? Not necessarily. Criminals can get such details from data leaks. See how to check for a breach.
Should I reply "STOP"? It is better not to reply at all; just report and block the sender.
Three questions to ask before you click
Was I expecting this message? Does it ask me to hurry? Does it ask me for something that a real company would never ask by message, such as a PIN or OTP? If the answer to any of these is yes, do not click the link or reply.
Check the message another way
If a message says your bank account is blocked, open the bank's app yourself or call the number printed on your card. If a parcel company says delivery failed, open the courier's official app or website by typing the name. Never use the contact details inside the message.
Help others learn
Phishing works because people are busy and scared. Share a screenshot of a scam message with the family group with a short note that it is fake. A real example teaches more than a lecture.
Reading a link like an investigator
A web address has a main part that decides who owns the site: the words just before the first single slash, such as example.com in https://login.example.com/page. In a trick link, the real brand is often placed on the left and the actual domain is somewhere else, for example yourbank.secure-update.example. Always look at the part just before the first slash and read it slowly. Short links hide the full address; if you do not know the sender, do not open them.
Three common examples
The courier message. "Your parcel is held, pay a small fee to release it." The fee is the bait, and the page asks for card details or UPI PIN. If you are really expecting a parcel, open the courier's own app or website and enter your tracking number.
The KYC update. "Your account will be blocked today; update KYC by clicking here." Banks do not block accounts through a hurried SMS link. Open your bank's app yourself and see whether any request is shown there.
The prize or refund. "You have won a gift" or "tax refund approved" messages are designed to make you enter bank details to receive something you never earned. If you did not enter a contest, you did not win.
Different channels, same trick
Phishing by SMS is sometimes called smishing, and phishing by phone call is called vishing. The method is the same: a message that frightens or tempts you, then a request for a code, a password or a payment. A QR code in an email or on a poster can also lead to a fake page, so treat unknown QR codes like unknown links.
Check without clicking
- Open the official app or type the official address yourself.
- Look at the sender: the email address, not just the display name.
- Read the language: strange grammar, odd spacing and a sense of panic are warning signs, but a well-written message is not proof of honesty.
- Ask someone: a quick message to a family member costs nothing.
What to do if you clicked
If you only opened the page and entered nothing, close it and clear the browser data. If you typed a password, change it immediately on the real site and on any other site where you used it. If you entered card or banking details, call your bank at once and block the card. If you installed an app, uninstall it, run a Play Protect scan and change your passwords from another device.
Where to report
Use the cybercrime.gov.in portal or call 1930 for financial fraud. The Sanchar Saathi portal also offers a way to report suspected fraud calls and messages. In Gmail, use the "Report phishing" option so the message is flagged for others. Reporting protects people who have not yet seen the message.
User Comments (0)
Apps to explore
