How to Recognize Phishing Emails and Fake Websites

Phishing tries to trick you into revealing passwords, OTPs, or card details by pretending to be a bank, delivery company, employer, or government office. This guide focuses on recognition habits you can use every day — not fear, and not guarantees that every scam can be spotted.

What phishing looks like in daily life

A message creates urgency: “Your account will be locked today,” “Pay a small fee to receive a refund,” or “Confirm your KYC in 10 minutes.” It pushes you to click a link, scan a QR code, call an unknown number, or share an OTP.

Fake websites often copy logos and colours but use odd domain names, extra words, or misspellings. Hovering (on desktop) or long-pressing a link (on mobile) can reveal a destination that does not match the brand.

Email and SMS red flags worth pausing for

Generic greetings, poor grammar, unexpected attachments, and requests for passwords or OTPs are classic warnings. Legitimate banks and most platforms do not ask you to share OTPs with anyone on a call or chat.

Also check the sender address carefully. Display names are easy to fake; the actual email domain matters more. If a message is unexpected, open the official app or type the official website yourself instead of using the link in the message.

Never share OTPs, passwords, or full card details over phone or chat.
Be suspicious of “act now or lose access” pressure.
Prefer official apps over links in unexpected messages.

How to spot a lookalike website

Look at the full URL. Extra hyphens, random numbers, or unfamiliar country domains can be clues. A lock icon alone is not proof of safety — many fake sites also use HTTPS.

Compare the address with one you already trust from a previous genuine visit. For government services, prefer known .gov.in domains and habits described in our guide on identifying genuine government websites.

What to do if you already clicked

If you entered a password, change it immediately on the real site using a device and network you trust, then enable two-factor authentication where available. If you shared banking details or completed a payment, contact your bank through the number on the back of your card or the official app.

Monitor account alerts. Report the phishing message to your email provider or phone’s spam tools so similar messages are filtered.

Daily habits that reduce risk

Use unique passwords for email and banking, and a password manager or a strong generator for new passwords. Our password generator tool can help you create long random passwords you store safely.

Keep devices updated, avoid unknown APK files, and treat QR codes from posters or messages with the same caution as links. For broader habits, see online privacy basics.

Conclusion

Slow down when a message demands fast action. Verify through official apps and known addresses, protect OTPs, and use strong unique passwords. Caution is a skill — and it is usually enough to avoid the most common phishing traps.