# How to Spot a Phishing Email or SMS and Report It in India

> Learn the warning signs of phishing emails and SMS, what to do if you clicked, and how to report to your bank, Sanchar Saathi Chakshu, 1930 and cybercrime.gov.in.

Source: https://www.epifive.com/blog/phishing-email-sms-how-to-spot-report-india · Published 2026-10-28 · EpiFive

## Key takeaways

- Phishing messages push urgency and ask for an OTP, PIN, password or card details, which a genuine bank or service does not request.
- Do not click links in unexpected messages; open the official app or type the website address yourself.
- Report suspicious calls, SMS and WhatsApp messages through Chakshu on the Sanchar Saathi portal.
- If you have lost money, tell your bank first, then report to 1930 or cybercrime.gov.in.
- Keep screenshots, sender details and transaction information before you delete anything.

A phishing email or SMS tries to rush you into clicking a link or sharing an OTP, PIN, password or card details by pretending to be a bank, courier, government body or employer. The safest response is to ignore the link, open the official app or website yourself, and report the message. In India you can report suspicious calls, SMS and WhatsApp messages through the Chakshu facility on the Sanchar Saathi portal, and report a financial loss to your bank and to 1930 or cybercrime.gov.in.

## Who this is for and what you will have at the end

This guide is for anyone who gets suspicious emails or text messages about KYC updates, blocked accounts, parcels, prizes, refunds or electricity bills. At the end you will have a checklist for judging a message, a plan for the first minutes after a mistake, and a table of where to report each type of problem. Portal forms and menu names change, so follow the prompts on the current page when you file a report.

## What phishing looks like

Phishing arrives by email, SMS (often called smishing), phone call (vishing) and messaging apps. The RBI's awareness booklet lists vishing and phishing links among the common tactics used against digital payment users. Typical themes include:

- Your bank account, wallet, SIM, gas connection or electricity connection will be blocked unless you update KYC.
- A prize, lottery or refund is waiting for you.
- A parcel could not be delivered, and you must pay a small fee.
- A person claiming to be a government official or a relative needs money urgently.
- A "job offer" that asks you to pay or share documents first.

## Warning signs checklist

| Sign | What to do |
| --- | --- |
| Urgency or threats such as "account blocked in 2 hours" | Pause. Real institutions do not pressure you into instant action by SMS |
| Request for an OTP, UPI PIN, password, CVV or card number | Never share these. No genuine service needs them from you by message or call |
| A link that is shortened or does not match the real site | Do not click. Type the address yourself or use the official app |
| Sender name or number that does not match the organisation | Check using the organisation's own website |
| Unexpected attachment or a request to install an app | Do not open or install it |
| Poor spelling, generic greeting or odd formatting | Treat with suspicion, but remember polished messages can still be phishing |
| Message about something you did not do or order | Ignore it, and check directly with the company |

## What to check before you act

1. **Do not click.** Go to the organisation's app or type its website address from memory or from your card or statement.
2. **Look at the sender.** For email, check the full address and domain. For SMS, be careful with sender IDs that look official, since appearance alone is not proof.
3. **Check the request.** Any request for secrets such as OTP or PIN is a red flag in itself.
4. **Call the official number**, taken from the back of your card or the organisation's website, not from the message.
5. **Ask someone** you trust if you are unsure, before you act.

## If you clicked or shared something

Speed matters. Work through this list in order.

1. **Stop interacting.** Close the page and do not enter anything more. If you have installed an unknown app on request, remove it.
2. **Call your bank** using its official number. Ask them to block cards, UPI and net banking if you shared credentials or an OTP.
3. **Change passwords** on the affected account and any account that reuses the password. Do this from a device you trust.
4. **Turn on stronger sign-in** such as an authenticator app where available.
5. **Report the fraud** if money was lost, to 1930 and cybercrime.gov.in.
6. **Keep evidence:** screenshots of the message, the sender, the link, and any payment confirmations.

## How to report in India

### Suspicious call, SMS or WhatsApp message: Chakshu

The Department of Telecommunications runs Chakshu on the Sanchar Saathi portal (sancharsaathi.gov.in). Public descriptions of the service say you can report suspected fraudulent communications received by call, SMS or WhatsApp, for example about KYC expiry or update of a bank account, wallet, SIM, gas or electricity connection, sextortion, or impersonation of a government official or relative to get money. You select the medium and category, enter the number the communication came from and other details, and can add an optional screenshot. Chakshu is not designed for reporting financial fraud where money has already been lost.

### Money lost: 1930 and cybercrime.gov.in

If you have lost money, call the national cybercrime helpline 1930 or file a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in. The government describes the helpline as a way to get assistance in lodging online cyber complaints. Complaints on the portal are handled by the relevant State or Union Territory law enforcement agency.

### Your bank

Tell your bank first about any money lost or any credential you shared. Ask for a complaint reference number.

### CERT-In

CERT-In, the Indian Computer Emergency Response Team, handles cyber security incidents. Its website explains how to report an incident; follow the steps published there.

### The platform

Use the report options in your email service or messaging app. This helps filter future messages, but it does not replace reporting to the authorities if you lost money.

## Where to report what

| Situation | Where to go |
| --- | --- |
| Suspicious call, SMS or WhatsApp, no loss | Chakshu on Sanchar Saathi |
| Money lost or credentials shared | Your bank, then 1930 or cybercrime.gov.in |
| Suspicious email or site | The email provider, plus CERT-In as described on its website |
| Unwanted numbers in your name | TAFCOP on Sanchar Saathi |

## Protecting yourself in advance

- Keep your phone, apps and browser updated.
- Use unique passwords and a password manager.
- Turn on two-step verification, preferring an authenticator app where possible.
- Set sensible limits and alerts on bank and UPI accounts.
- Never share OTPs, PINs or CVV with anyone, including someone who says they are from your bank.
- Download apps only from official app stores.
- Be careful about the personal information you post publicly.

## Troubleshooting

- **The message uses my name and the last digits of my account.** Scammers can obtain details from earlier leaks. Details alone do not prove the sender is genuine.
- **The link opens a page that looks exactly like my bank.** Close it. Appearance can be copied. Use the official app or type the address yourself.
- **I cannot tell if a message is real.** Do not act on it. Contact the organisation through its official website.
- **I reported on the portal but heard nothing.** Keep your reference number and follow up with your bank and local police as advised on the portal.

## Checklist

- Do not click links in unexpected messages.
- Never share OTPs, PINs, CVV or passwords.
- Verify through the official app or website.
- If you shared something or paid, call your bank at once.
- Report no-loss fraud communications through Chakshu.
- Report losses to 1930 and cybercrime.gov.in.
- Keep screenshots and details as evidence.

For related guides, see [SIM swap fraud in India: warning signs and protection](https://www.epifive.com/blog/sim-swap-fraud-india-protect-yourself) and [Fake customer care number scam: how to avoid it](https://www.epifive.com/blog/fake-customer-care-number-scam-how-to-avoid).

## References

- Reserve Bank of India, BE(A)WARE booklet: https://www.rbi.org.in/commonman/Upload/english/Content/PDFs/English%20BEAWARE.pdf
- Sanchar Saathi, Department of Telecommunications: https://sancharsaathi.gov.in/
- Press Information Bureau, Chakshu facility of Sanchar Saathi: https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2223779&reg=3&lang=2
- National Cyber Crime Reporting Portal: https://cybercrime.gov.in/
- CERT-In: https://www.cert-in.org.in/

## Frequently asked questions

### How can I tell if an SMS or email is phishing?

Warning signs include urgency or threats, a request for an OTP, PIN, password or card details, a link that does not lead to the real website, and a message about KYC expiry or a blocked account that you were not expecting. When in doubt, do not click. Open the official app or type the website address yourself.

### Where do I report a suspicious call, SMS or WhatsApp message in India?

The Department of Telecommunications offers the Chakshu facility on the Sanchar Saathi portal to report suspected fraud communications received by call, SMS or WhatsApp, such as fake KYC updates. You choose the category, enter the sender details and can add an optional screenshot.

### What should I do if I clicked a phishing link or shared an OTP?

Contact your bank at once using the official number, ask them to block cards or UPI if needed, change affected passwords from a safe device, and if money has been lost report to 1930 or cybercrime.gov.in. Keep screenshots and transaction details.

### Is Chakshu the place to report a financial loss?

No. Chakshu is for reporting suspected fraud communications before or without a loss. If money has already been taken, use the cybercrime helpline 1930 or cybercrime.gov.in, and tell your bank straight away.