Last updated: November 2026. If you have already shared an OTP, PIN or card details, or money has left your account, call 1930 or report at cybercrime.gov.in right away, then call your bank to block the card or account.
Most online fraud in India does not start with clever hacking. It starts with a message: an SMS saying your electricity will be cut tonight, an email saying your bank KYC has expired, a WhatsApp message with a “parcel tracking” link, or a call from someone claiming to be a police officer. The goal is always the same: make you panic, click, and hand over a password, an OTP or money.
The good news is that these scams follow patterns. Once you know the signs, most of them are easy to spot. This guide walks through the most common types, the clues that give them away, and exactly what to do if you have already clicked.
Why phishing works
Phishing messages are designed to stop you from thinking. They usually rely on one of four emotions:
- Fear: “Your account will be blocked today”, “A case has been registered against you”.
- Urgency: “Update within 2 hours”, “Last reminder”.
- Greed: “You have won a reward”, “Claim your refund”, “Earn ₹5,000 a day from home”.
- Helpfulness or trust: a message that seems to come from your boss, a relative or a familiar company.
If a message makes you feel any of these strongly, treat that feeling itself as a warning sign. Slow down before you act.
Check the SMS sender code first
Genuine business SMS in India are sent through registered headers (short names such as a bank’s or company’s code) rather than ordinary 10-digit mobile numbers. Under TRAI’s rules, these headers now also carry a letter at the end that tells you what kind of message it is:
| Suffix | Type of message | Example of what to expect |
|---|---|---|
| -P | Promotional | Offers and advertisements |
| -S | Service | Account alerts, delivery updates, bill reminders |
| -T | Transactional | OTPs and transaction confirmations |
| -G | Government | Messages from government departments |
Two practical rules follow from this:
- A “bank” or “electricity board” message from a normal 10-digit mobile number is almost certainly fake. Real organisations do not send account warnings from personal numbers.
- A correct-looking header is not a guarantee. Scammers sometimes misuse registered headers or send messages through messaging apps. Always check the content and the link too.
Ten warning signs of a scam message
- It asks for an OTP, PIN, CVV or password. No bank, UPI app, telecom company or government office will ever ask for these. An OTP is meant only for you to type into a screen you opened yourself.
- It threatens immediate action. “Electricity will be disconnected at 9:30 pm”, “SIM will be blocked in 24 hours”, “KYC expired, account frozen”.
- The link looks slightly wrong. Watch for extra words, hyphens or misspellings, such as a bank name followed by “-kyc-update” or a strange ending like “.xyz”, “.top” or “.info”.
- It uses a link shortener (a short random-looking link) for something official like a tax refund or bank update.
- It asks you to install an app, especially a screen-sharing app or an APK file sent on WhatsApp. These can give scammers control of your phone.
- The greeting is generic, such as “Dear Customer” or “Dear User”, when your bank normally uses your name.
- The email sender address does not match the brand. The display name may say a well-known company, but the actual address is a free email account or an unrelated domain.
- There are spelling and grammar mistakes or odd formatting that a large organisation would not send.
- It offers something too good to be true: a prize you did not enter, a refund you did not expect, or easy daily earnings for liking videos or rating hotels.
- It asks you to “receive” money by scanning a QR code or entering your UPI PIN. You never need your PIN to receive money; entering it only sends money out.
Common scams in India right now
Fake KYC and account-block messages
A message claims your bank account, PAN or wallet will be blocked unless you “update KYC” through a link. The link leads to a fake login page that captures your net-banking password and OTP. Banks do ask customers to update KYC, but you can always do it through the bank’s official app, website or branch, never through a link in a random SMS.
Electricity bill disconnection
The message says your power will be cut tonight because the last bill was not updated, and gives a mobile number to call. The “officer” then asks you to install an app or pay a small amount, which leads to your account being emptied. Check your bill status only on your electricity company’s official website or app.
Parcel, courier and customs scams
A link says a delivery failed and asks for a small “re-delivery fee”, or a caller claims a parcel in your name contains illegal items. Track parcels only on the courier’s official site using a tracking number from the seller.
“Digital arrest” calls
Callers pretend to be from the police, CBI, customs or another agency, often on a video call with fake uniforms and backgrounds. They say you are involved in a crime and must stay on the call and transfer money for “verification”. There is no such thing as a digital arrest under Indian law. Real investigating agencies do not arrest people over video calls or ask for money to clear their name. Hang up and report the number.
Job and task scams
You are offered money for simple online tasks such as liking videos or writing reviews. The first few payments are small and real, to build trust. Then you are asked to “invest” larger amounts to unlock bigger earnings, and the money disappears.
Impersonation of friends and family
A message from a new number says “Hi, this is my new number”, followed by an urgent request for money. Call the person on their old number before sending anything.
How to check a link safely
- Do not tap to “see what it is”. Long-press (on a phone) or hover (on a computer) to see the full address first.
- Read the domain from right to left. In an address like bank-name.secure-login.example.com, the real site is example.com, not the bank.
- Type addresses yourself or use the official app. Bookmark your bank’s real website and use only that bookmark.
- Do not trust the padlock alone. The padlock means the connection is encrypted, not that the site is genuine. Fake sites can have padlocks too.
- Search for the official site carefully. Sponsored search results can sometimes be fake, so check the domain before entering details.
What to do if you have already clicked
Clicking a link alone does not always cause harm, but act quickly depending on what happened:
- If you entered a password: change it immediately on the real website, and change it anywhere else you used the same password. Turn on two-factor authentication; our guide to strong passwords and 2FA explains how.
- If you shared card or bank details or an OTP: call your bank’s official helpline to block the card, freeze net banking or UPI, and dispute any transaction.
- If money has been taken: call 1930 or file a complaint at cybercrime.gov.in as soon as possible. The faster you report, the better the chance of freezing the money. Our step-by-step guide on reporting UPI fraud and getting money back covers what to do next.
- If you installed an app or shared your screen: turn on aeroplane mode, uninstall the app, and run a security scan. If you are unsure, back up your photos and reset the phone. Then change your banking and email passwords from a different, safe device.
- If you shared Aadhaar details: lock your biometrics and review authentication history; see our Aadhaar safety guide.
How to report scam messages and numbers
- Chakshu on Sanchar Saathi: the Department of Telecommunications’ Sanchar Saathi portal and app have a “Chakshu” option for reporting suspected fraud calls, SMS and WhatsApp messages, even if you did not lose money.
- Spam and unwanted commercial messages: you can report them to your mobile operator or through TRAI’s DND app.
- Financial fraud: 1930 or cybercrime.gov.in, plus your bank.
- Inside apps: use the “Report” or “Block” option in WhatsApp, Telegram, email or social media so the platform can act against the account.
Habits that protect your whole family
- Agree on a simple family rule: nobody shares an OTP, ever, and any urgent money request is confirmed by a phone call.
- Talk to elderly parents about “digital arrest” and electricity-bill scams, which often target them.
- Keep phone software and apps updated, and install apps only from the official app store.
- Set daily limits for UPI and online card transactions in your banking app.
- Turn on SMS and email alerts for every transaction so you notice misuse immediately.
- If your phone is lost or stolen, block it quickly; see our Sanchar Saathi (CEIR) guide.
Frequently asked questions
Can I get hacked just by opening an SMS or email?
Simply reading a message is generally safe on an updated phone. The risk comes from tapping links, downloading attachments or apps, and entering details. Keep your phone updated to reduce the small risk from rare software flaws.
My bank really did send me a link. How do I know it is genuine?
When in doubt, ignore the link and open the bank’s official app or type its website address yourself. If the request is real, you will see it there too, or you can confirm by calling the number printed on your card or passbook.
Is a message with my name and account details more likely to be real?
Not necessarily. Scammers sometimes have partial information from data leaks. Personal details make a message more convincing, not more trustworthy.
Someone sent me money by mistake and is asking me to return it. What should I do?
Be careful: this is a common trick. Check your bank statement directly in the app. If money really arrived, contact your bank rather than sending it to a number the stranger gives you.
Bottom line
Scam messages rely on panic and speed. Check the sender, read the link before you tap, never share an OTP or PIN, and verify any urgent request through an official channel. If something has already gone wrong, report it to 1930 and your bank immediately; speed matters more than anything else.
Disclaimer: This article is general awareness information, not legal or technical advice. Scam methods change quickly, and helpline numbers, portals and rules can be updated. Always follow the latest instructions from your bank, your telecom operator and official government sources. Read our full disclaimer.