If a message pressures you to act, asks for a password or one-time code, or sends you to a link you were not expecting, pause. It could be phishing: a message or call designed to trick you into revealing information, opening a harmful file, or sending money. The safest first move is to avoid the link and verify the request through an official app, website, or phone number you find independently.
Phishing is not limited to email. It can arrive by SMS, messaging apps, social media, a phone call, or a fake website. The examples below are illustrative, not reports of specific incidents. Scammers can imitate familiar brands, so a polished logo or a message that uses your name is not proof that it is genuine.
What phishing looks like
Imagine receiving a text that says a parcel is held and asks you to pay a small fee through a link. Or an email says your bank account will be blocked unless you “complete KYC now.” Another message might offer a job but ask you to pay a registration fee before an interview.
The stories differ, but the pressure is similar: do something quickly, keep it secret, or risk losing access, money, or an opportunity. A familiar story is only a reason to check carefully; it is not proof of fraud by itself.
Seven warning signs to check
1. The message creates urgency or fear
“Your account closes in 10 minutes” is designed to make you react before thinking. A genuine service may send reminders, but urgency alone cannot verify who sent a message. Stop and check through the service's official app or website instead.
2. It asks for secrets or payment details
Do not share passwords, one-time passwords, PINs, recovery codes, or full card details with someone who contacts you unexpectedly. A caller's claim to be from a bank, delivery company, employer, or support team does not establish their identity.
If someone asks you to reveal a code or approve an unexpected transaction, end the conversation and contact the organization using a number or support path from its official website or app.
3. The link does not match the service
On a phone, press and hold a link only if you can do so without opening it, to inspect the destination. Look for misspellings, extra words, unusual endings, or a domain that is unrelated to the organization. Do not enter credentials just because a page has the right colors or logo.
When in doubt, open the official app yourself or type a known website address into the browser. Avoid using the link in the suspicious message.
4. The sender identity feels slightly off
Check the full email address or account handle, not just the display name. But remember: sender details can be imitated, and a message from a familiar-looking account may still be unsafe if it asks for something unusual.
If a friend or colleague sends a strange payment request, contact them another way using a number or channel you already know.
5. It asks you to install an app or file
Be cautious with unexpected attachments, remote-access apps, “security updates,” or files shared through a message. Do not install software because a stranger says it will fix a payment or account issue. Use the official app store or provider website, and verify the request independently.
6. It promises an unusually easy reward
Unexpected prize claims, guaranteed income, or a job offer that skips ordinary steps can be used to draw you into sharing data or paying a fee. Treat the promise as a reason to verify the employer, offer, and process—not as proof of a scam on its own.
7. It discourages independent checks
Requests to stay on the call, not contact your bank, or keep a “special process” secret are serious warning signs. End the conversation. Find the organization's official contact details yourself and ask whether the request is genuine.
A safe way to verify a suspicious message
Use this short routine before replying, tapping, or paying:
- Pause. Do not act while a message is creating pressure.
- Do not use its contact details. Avoid the message's link, phone number, QR code, or reply address.
- Open a separate, trusted route. Use the official app already on your device, type a known website address yourself, or use contact details from a bank card or an official statement.
- Ask whether the request is real. Contact the organization through that trusted route. For a person you know, use another channel.
- Do not share a verification code or PIN. If you are asked to approve something, stop and check exactly what the approval does before continuing.
- Save evidence if safe. Keep the message, sender details, time, and any transaction reference. Do not forward suspicious links to other people.
For Google accounts, Google's guidance is to avoid clicking links, downloading attachments, or entering personal information in messages or websites from unknown or untrusted senders. Use the linked help page in the sources for current instructions.
If you already clicked or shared something
Do not panic, but act promptly. What to do depends on what happened:
- You entered a password: Open the genuine service directly, change the password, and review account recovery details and active sessions. If you reused that password elsewhere, change it on those accounts too.
- You shared a one-time code or PIN: Contact the relevant bank or service immediately through its official app or independently verified phone number. Ask what protections or account actions are available.
- You installed an app or file: Disconnect from sensitive accounts on that device if you can do so safely. Use the operating system's security tools or a trusted professional to check it, and change important passwords from a different, trusted device.
- Money may have moved: Contact your bank or payment provider using its official channel as soon as possible. Save transaction IDs and messages. Report through the official Indian cybercrime reporting portal and follow its current instructions. Confirm the correct portal workflow and any helpline details from official government sources immediately before publication; procedures can change.
- You only opened a page: Close it. If you did not enter details, download a file, install an app, or approve a prompt, the next steps may differ. Check your browser and account activity, and seek help if anything looks unfamiliar.
Do not trust a person who contacts you unexpectedly and promises to recover money for an upfront fee. Verify any support service independently.
Make your accounts harder to take over
These habits help limit damage if a message slips through:
- Use a different, strong password for each important account. A reputable password manager can help you keep track.
- Turn on the strongest multi-factor sign-in option the service supports, and store recovery codes somewhere safe.
- Keep your phone, browser, and apps updated through their official update mechanisms.
- Review account recovery email addresses, phone numbers, and signed-in devices periodically.
- Use screen locks and do not leave banking or email accounts open on shared devices.
- Back up important files, and make sure you know how to restore them.
No single setting makes an account invulnerable. The goal is to make unexpected requests easier to question and account recovery easier if something goes wrong.
Key Takeaways
- Pause when a message pressures you to act.
- Verify requests through a separate official route—not the message's link or number.
- Never disclose passwords, one-time codes, recovery codes, or PINs to an unexpected caller or message.
- If money or account access may be affected, contact the bank or service using independently verified details.
- Use official government and service instructions for reporting, and check that those instructions are current.
Frequently asked questions
Is every unexpected message a phishing scam?
No. An unexpected message can be legitimate, mistaken, or fraudulent. Treat it as unverified until you check the request through a separate route. Do not decide based only on the logo, sender name, or how polished the writing looks.
Can a message be fake even if it uses my name?
Yes. Personal details in a message do not prove who sent it. Check the request and contact the organization independently, especially if it asks for a code, password, payment, or urgent account action.
What should I do if I shared an OTP or password?
Contact the affected service or bank through its official app or a phone number you find independently. Change a compromised password from a trusted device, review active sessions and recovery details, and change any other account that reused the same password. Follow the provider's current instructions.
Where can I report a suspected online financial scam in India?
Use the official National Cyber Crime Reporting Portal at cybercrime.gov.in and contact your bank or payment provider through an official channel if money or payment details are involved. Confirm the portal's current submission steps and any telephone reporting number with official government sources before publishing or acting.
A good next step
Open the security settings for your primary email account today. Check its recovery details, review signed-in devices, and enable a strong second sign-in method if available. Then share this checklist with someone who may be under pressure to act on a suspicious message.
Sources to cite
- Google: Avoid and report phishing emails — guidance on suspicious messages and links.
- National Cyber Crime Reporting Portal — Confirm current reporting options and instructions before publication.