A phishing email or SMS tries to rush you into clicking a link or sharing an OTP, PIN, password or card details by pretending to be a bank, courier, government body or employer. The safest response is to ignore the link, open the official app or website yourself, and report the message. In India you can report suspicious calls, SMS and WhatsApp messages through the Chakshu facility on the Sanchar Saathi portal, and report a financial loss to your bank and to 1930 or cybercrime.gov.in.
Who this is for and what you will have at the end
This guide is for anyone who gets suspicious emails or text messages about KYC updates, blocked accounts, parcels, prizes, refunds or electricity bills. At the end you will have a checklist for judging a message, a plan for the first minutes after a mistake, and a table of where to report each type of problem. Portal forms and menu names change, so follow the prompts on the current page when you file a report.
What phishing looks like
Phishing arrives by email, SMS (often called smishing), phone call (vishing) and messaging apps. The RBI's awareness booklet lists vishing and phishing links among the common tactics used against digital payment users. Typical themes include:
- Your bank account, wallet, SIM, gas connection or electricity connection will be blocked unless you update KYC.
- A prize, lottery or refund is waiting for you.
- A parcel could not be delivered, and you must pay a small fee.
- A person claiming to be a government official or a relative needs money urgently.
- A "job offer" that asks you to pay or share documents first.
Warning signs checklist
| Sign | What to do |
|---|---|
| Urgency or threats such as "account blocked in 2 hours" | Pause. Real institutions do not pressure you into instant action by SMS |
| Request for an OTP, UPI PIN, password, CVV or card number | Never share these. No genuine service needs them from you by message or call |
| A link that is shortened or does not match the real site | Do not click. Type the address yourself or use the official app |
| Sender name or number that does not match the organisation | Check using the organisation's own website |
| Unexpected attachment or a request to install an app | Do not open or install it |
| Poor spelling, generic greeting or odd formatting | Treat with suspicion, but remember polished messages can still be phishing |
| Message about something you did not do or order | Ignore it, and check directly with the company |
What to check before you act
- Do not click. Go to the organisation's app or type its website address from memory or from your card or statement.
- Look at the sender. For email, check the full address and domain. For SMS, be careful with sender IDs that look official, since appearance alone is not proof.
- Check the request. Any request for secrets such as OTP or PIN is a red flag in itself.
- Call the official number, taken from the back of your card or the organisation's website, not from the message.
- Ask someone you trust if you are unsure, before you act.
If you clicked or shared something
Speed matters. Work through this list in order.
- Stop interacting. Close the page and do not enter anything more. If you have installed an unknown app on request, remove it.
- Call your bank using its official number. Ask them to block cards, UPI and net banking if you shared credentials or an OTP.
- Change passwords on the affected account and any account that reuses the password. Do this from a device you trust.
- Turn on stronger sign-in such as an authenticator app where available.
- Report the fraud if money was lost, to 1930 and cybercrime.gov.in.
- Keep evidence: screenshots of the message, the sender, the link, and any payment confirmations.
How to report in India
Suspicious call, SMS or WhatsApp message: Chakshu
The Department of Telecommunications runs Chakshu on the Sanchar Saathi portal (sancharsaathi.gov.in). Public descriptions of the service say you can report suspected fraudulent communications received by call, SMS or WhatsApp, for example about KYC expiry or update of a bank account, wallet, SIM, gas or electricity connection, sextortion, or impersonation of a government official or relative to get money. You select the medium and category, enter the number the communication came from and other details, and can add an optional screenshot. Chakshu is not designed for reporting financial fraud where money has already been lost.
Money lost: 1930 and cybercrime.gov.in
If you have lost money, call the national cybercrime helpline 1930 or file a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. The government describes the helpline as a way to get assistance in lodging online cyber complaints. Complaints on the portal are handled by the relevant State or Union Territory law enforcement agency.
Your bank
Tell your bank first about any money lost or any credential you shared. Ask for a complaint reference number.
CERT-In
CERT-In, the Indian Computer Emergency Response Team, handles cyber security incidents. Its website explains how to report an incident; follow the steps published there.
The platform
Use the report options in your email service or messaging app. This helps filter future messages, but it does not replace reporting to the authorities if you lost money.
Where to report what
| Situation | Where to go |
|---|---|
| Suspicious call, SMS or WhatsApp, no loss | Chakshu on Sanchar Saathi |
| Money lost or credentials shared | Your bank, then 1930 or cybercrime.gov.in |
| Suspicious email or site | The email provider, plus CERT-In as described on its website |
| Unwanted numbers in your name | TAFCOP on Sanchar Saathi |
Protecting yourself in advance
- Keep your phone, apps and browser updated.
- Use unique passwords and a password manager.
- Turn on two-step verification, preferring an authenticator app where possible.
- Set sensible limits and alerts on bank and UPI accounts.
- Never share OTPs, PINs or CVV with anyone, including someone who says they are from your bank.
- Download apps only from official app stores.
- Be careful about the personal information you post publicly.
Troubleshooting
- The message uses my name and the last digits of my account. Scammers can obtain details from earlier leaks. Details alone do not prove the sender is genuine.
- The link opens a page that looks exactly like my bank. Close it. Appearance can be copied. Use the official app or type the address yourself.
- I cannot tell if a message is real. Do not act on it. Contact the organisation through its official website.
- I reported on the portal but heard nothing. Keep your reference number and follow up with your bank and local police as advised on the portal.
Checklist
- Do not click links in unexpected messages.
- Never share OTPs, PINs, CVV or passwords.
- Verify through the official app or website.
- If you shared something or paid, call your bank at once.
- Report no-loss fraud communications through Chakshu.
- Report losses to 1930 and cybercrime.gov.in.
- Keep screenshots and details as evidence.
For related guides, see SIM swap fraud in India: warning signs and protection and Fake customer care number scam: how to avoid it.
References
- Reserve Bank of India, BE(A)WARE booklet: https://www.rbi.org.in/commonman/Upload/english/Content/PDFs/English%20BEAWARE.pdf
- Sanchar Saathi, Department of Telecommunications: https://sancharsaathi.gov.in/
- Press Information Bureau, Chakshu facility of Sanchar Saathi: https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2223779®=3&lang=2
- National Cyber Crime Reporting Portal: https://cybercrime.gov.in/
- CERT-In: https://www.cert-in.org.in/
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.