Phishing Scams in India 2026: Spot and Stop Them

How a careful person nearly hands over their Aadhaar

Picture a retired school principal. Sharp, cautious, not the kind of person you'd expect to fall for anything online. An SMS arrives saying her PAN card will be deactivated in 48 hours unless she "verifies" it through a link. The message looks official, and the page it opens is a dead ringer for the Income Tax Department website. She enters her PAN number and is about to type her Aadhaar.

Variations of this happen to careful people every day, which is the point: if someone like her can be tricked, so can the rest of us.

The badly spelled Nigerian prince emails are mostly gone. What lands in our inboxes now is clean Hindi and English, pretending to come from banks, the Income Tax Department, delivery services and UPI apps, which are the places most of us deal with every day. This guide collects the most common phishing templates aimed at Indians, drawn from CERT-In and bank advisories, police cyber cell alerts and reported cases, and shows how to spot each one.

Why phishing works so well (it's not because people are dumb)

Victims aren't careless or slow. The retired principal in the example above ran a school for decades.

Phishing goes after your emotions. Scammers lean on four triggers: fear ("your account will be blocked"), greed ("you've won a prize"), urgency ("within 24 hours") and authority ("this is from the Income Tax Department"). Once one of them kicks in, your brain stops analysing and starts reacting. Clever people included.

Timing helps them too. The "bank alert" shows up while you're cooking dinner, or the "delivery notification" pops up in the middle of a work meeting, and you glance at it, it looks official, you tap. Nobody sits down with a magnifying glass for every message. The scammers count on that.

Then there's volume. Security vendors' estimates for phishing attempts against Indian users run into the tens of millions a year, and at that scale it's a numbers game. Send a fake SBI message to ten million people and even a 0.1% hit rate gives you 10,000 compromised accounts.

The scams you're most likely to see

KYC update scams

An SMS or email says your bank account, wallet or mobile connection will be suspended unless you complete a KYC update right now. The link goes to a fake site that looks exactly like your bank's portal.

"Dear Customer, your [Bank Name] account will be blocked within 24 hours due to incomplete KYC. Update now: http://bankname-kyc-update.com/verify"

It works because KYC updates are real. Banks do ask for them from time to time, and people worry about frozen accounts, especially since RBI tightened enforcement. Then the "24 hours" deadline does the rest.

How to catch it: banks don't send KYC links by SMS. They tell you to visit a branch or use the official app. The URL will be slightly off (sbi-kyc-update.com instead of onlinesbi.sbi.co.in). You'll see "Dear Customer" instead of your name, and there's always a fake deadline.

I've collected a few versions of this one. Some cite specific regulations ("as per RBI Circular dated...") to sound official. Others include part of an account number, usually the last four digits, so you assume the scammer already knows your details. They don't, since the same message goes to millions of people and those four digits are generic or random, but it plants enough doubt.

Income tax refund scams

An email or SMS says the Income Tax Department has approved a refund for you, and all you have to do is click the link and enter your bank details. The odd rupee amount (Rs 15,490 rather than a round number) makes it feel real. Refunds do happen.

"Your income tax refund of Rs 15,490 has been approved. Claim your refund by verifying your account details at: http://incometax-refund-verify.in/claim"

The real portal is incometax.gov.in, and anything else is fake. The IT Department never asks for bank details by email, because refunds go to the bank account you linked in your return. Check the sender's domain too: official mail comes from @incometax.gov.in or @gov.in.

These peak during filing season (July to September), for obvious reasons, but they run all year. And that specific amount is deliberate: "Rs 15,000" feels made up, while "Rs 15,490" looks like something a computer calculated, a small psychological trick that makes a big difference to how many people click.

Package delivery scams

"Your package couldn't be delivered. Reschedule by paying a Rs 25 fee." With how much we all order online, there's a decent chance you really do have something in transit when this arrives, and that's why it works.

"Your India Post package (tracking: IP2839471IN) could not be delivered. Reschedule delivery by paying Rs 25 fee: http://indiapost-redelivery.com/pay"

The tracking number looks legit and the fee seems tiny. But India Post and private couriers don't collect redelivery fees through random SMS links; real tracking updates come from the courier's own app or site, and this URL isn't the courier's domain.

The small amount is the hook. People think "it's just Rs 25, what's the worst that can happen?" The scammers don't care about the Rs 25. What they want is the payment page where you type your card number, expiry date and CVV, so they can drain the account later or sell the card details in bulk.

UPI collect request scams

This one breaks my heart because it's so simple and does so much damage. Someone calls pretending to be from your bank, a retailer or even the police. They say they're "sending you money" (a refund, a prize, whatever) and you just need to "accept" it. What arrives is a collect request, which is a debit request. You enter your PIN thinking you're receiving money. It leaves your account instead.

The whole trick is the confusion between a credit and a collect request. Once you understand how UPI payments work, these get much easier to spot.

Remember this one: you NEVER need to enter your UPI PIN to receive money. If someone says you do, it's a scam. No exceptions, no edge cases.

I've heard of a version where the scammer first sends a collect request for Re 1 and says, "I'm sending Re 1 to verify your account, just accept it." The victim sees the tiny amount, enters the PIN, loses Re 1 and now trusts the caller. Then the real collect request comes, for much more.

Job offer scams

A WhatsApp message or email offers work from home (data entry, product reviews, social media likes) with pay that's too good. The clever bit is that the first tasks are real and they do pay you small amounts, so once you trust them and they ask you to "invest" money to get higher-paying tasks, you pay. That money vanishes.

"Hi! We are hiring part-time workers for [Company Name]. Earn Rs 5,000-15,000 daily from home. Simple tasks. No experience needed. Contact us on WhatsApp: +91-XXXXXXXXXX"

No real job pays Rs 15,000 a day for "simple tasks," and companies don't hire through random WhatsApp messages. If a job wants you to pay money to earn money, it's a scam every time.

What makes these cruel is who they target: people who really need work, like college students, people between jobs and homemakers looking for extra income. Hope makes them vulnerable. The early payouts (sometimes Rs 200-500 for a few tasks) make it feel legitimate and get the victim emotionally invested, so by the time they're asked to "invest" Rs 5,000 for premium tasks, they've already convinced themselves it's real. I've talked to people who lost Rs 50,000-1,00,000 to these schemes before they figured out what was going on.

Loan approval scams

Someone calls to say you've been pre-approved for a loan at a great rate, and you only need to pay a small "processing fee" or "GST" upfront to release the money. Once you transfer it, they disappear. Some send a fake sanction letter with a bank's logo to make it look real, and some keep going for as long as the victim keeps paying: a processing fee, then a "verification fee," then an "insurance fee."

Real lenders take the processing fee out of the loan amount. They never ask for money in advance, and pre-approval calls from unknown numbers should always make you suspicious. If it sounds real, hang up and call the bank yourself on the number from its official website, not the number that called you.

Electricity/gas disconnection scams

This one has been growing fast. An SMS says your electricity bill is overdue and the connection will be cut today, with a number to call or a link to pay right away. People panic. Nobody wants the power going off with a fridge full of food or in the middle of summer. The link leads to a fake payment portal, or the number connects you to a scammer who asks for your bank details.

Your electricity board sends several notices before any disconnection, and it won't threaten you by SMS with a random payment link. Pay bills only through official apps (like the Tata Power or BSES apps), the utility's own website, or trusted bill payment platforms.

How to read a URL, the most useful thing I can teach you

This is the skill that stops the PAN scam above cold, so if you take one thing from this post, take this.

What a URL looks like

https://www.sbi.co.in/web/personal-banking/accounts
  |       |       |    |
  |       |       |    └── Path (page on the site)
  |       |       └── Domain (the actual website)
  |       └── Subdomain
  └── Protocol (https = secure)

The domain is the part that matters, and scammers get creative with it:

Read right to left. The last two parts before the first slash are the real domain. In sbi.co.in.verify-kyc.com the domain is verify-kyc.com, and the sbi.co.in in front of it is a subdomain dressed up to fool you.

Before you click any link in any message:

1. Does the domain match the official website exactly? If not, don't click.
2. Is it HTTPS? Banking and government sites always use it, but so do scam sites now, so HTTPS on its own proves nothing.
3. Any unnecessary hyphens or extra words? sbi-kyc-update.com isn't SBI. Real domains tend to be short and clean.
4. Check the TLD. .gov.in is for government, .co.in or .com for companies. .xyz, .tk and .buzz are red flags.
5. If you're unsure, type the official URL into your browser yourself.

Ten minutes is enough to teach this. Do it with your family: sit down with them and work through real examples instead of just telling them about it.

Going deeper: checking email headers

If a suspicious email lands in your inbox and you want to be sure, the headers show where it really came from.

Gmail: Open the email → three dots (More) → "Show original"

Outlook: Open the email → File → Properties → "Internet headers"

From: "State Bank of India" <alert@sbi-verify.com>
Return-Path: <bouncer@cheaphosting.xyz>
Received: from mail.scamserver.net (192.168.1.100)

The display name says "State Bank of India," which anyone can fake. The From address is sbi-verify.com, which isn't SBI's domain. The Return-Path points to cheaphosting.xyz, which is plainly bogus, and the Received header shows the mail came from scamserver.net. Real SBI emails come from @sbi.co.in or @onlinesbi.sbi.co.in. If it's anything else, delete it.

Most people won't check headers regularly, and that's fine. When an email looks almost right and you can't decide, though, the headers settle it. It's a bit like checking the expiry date on a food packet, something you might do a few times a year, not for every item, but when something smells off you know where to look.

Gut-level warning signs

On top of the technical checks, there are gut signals that something's wrong, and they're worth listening to.

If a message makes your stomach drop, your heart race, or your thumb move before your brain catches up, stop. That reaction is exactly what the message was built to cause, and real institutions don't talk to you through panic.

Watch the timing as well. A bank "alert" at 11 PM? A tax notice on a Sunday? Government offices and banks mostly work business hours, so a message at an odd time deserves a second look.

Tone gives scams away too. Real bank messages are dry and formal, so an "official" message full of exclamation marks (!!!), ALL CAPS or chummy language is off.

Be wary when someone asks for things they should already have. Your bank already has your PAN, so it doesn't need you to "verify" it. The Income Tax Department already has your bank account linked to your PAN, so it doesn't need you to type it in again. If someone wants information they should already hold, ask yourself why.

And sometimes a scam is too polished. I've seen fake SBI pages that looked cleaner and more modern than the real SBI website. If something looks suspiciously slick, especially when your bank's real site is clunky and dated, take that as a warning.

You already clicked. Now what?

Don't spiral. Move.

First 30 minutes. Change the passwords for the affected accounts. If you typed bank credentials into a fake site, change your net banking password now. Call your bank's helpline, report it, and ask them to freeze things temporarily if needed. Major bank numbers: SBI 1800-11-2211, HDFC 1800-202-6161, ICICI 1800-102-4242, Axis 1860-419-5555. Then go through recent transactions for anything you didn't do.

Save those helpline numbers in your phone today, before you need them. In a panic you don't want to be Googling for numbers, especially since scammers post fake helpline numbers that show up in search results.

First 24 hours. Report it at cybercrime.gov.in with all the details: the message, the link, what you entered. Call the national cybercrime helpline at 1930, which can freeze transactions that are still in progress. Forward the phishing SMS to 1909 (TRAI's DND service). If you downloaded anything from the fake site, run a full malware scan.

Be specific when you file at cybercrime.gov.in. Add screenshots of the message, the URL you clicked, what information you entered and any transaction details. More detail gives them a better chance of acting on it. Write down the complaint number too, since you'll need it for follow-ups and for your bank's dispute process.

Longer term. Watch your bank statements closely for the next 3-6 months, and turn on alerts for every debit, however small. If your Aadhaar or PAN was exposed, consider putting a fraud alert on your CIBIL profile so nobody can open credit in your name. Check your credit report for inquiries or accounts you don't recognise. The damage may not show up right away, because stolen identity details can be used weeks or months later.

Under RBI guidelines, if the fraud came from a third-party breach (not your own negligence, like sharing an OTP) and you report it within 3 working days, your liability is zero. Report it within 4 to 7 working days and you're liable for the transaction amount or a cap of Rs 5,000 to Rs 25,000 depending on your account type, whichever is lower. If the bank's own security was at fault, you owe nothing regardless. So report fast.

Protecting the people who are most vulnerable

Older relatives are frequent targets, and most of them don't have someone looking over their shoulder at the right moment.

Our parents and grandparents are online more than ever (UPI payments, WhatsApp, e-commerce), but they didn't grow up with any of this, and scammers target them far more than the rest of us.

Have the conversation. Sit down and go through the scam types above with real examples, and show them a genuine SBI SMS next to a fake one. There's nothing condescending about it.

How you frame it matters. "You need to be more careful" sounds like criticism, so try "these scams are so good that even cybersecurity experts get fooled sometimes, so here's what to watch for," which puts the focus on how skilled the scammers are. Showing news articles about tech-savvy young people who've been scammed too helps a lot. People feel less embarrassed about nearly falling for it, and they're much more open to learning the warning signs.

Set up their phone. Turn on spam call detection (built into most Android phones, or use Truecaller) and SMS filtering. Put a biometric lock on their UPI apps so a scammer can't make payments even with remote access, and switch on alerts for every bank transaction.

Here's the checklist I use. It takes about 20 minutes:

• Install Truecaller for spam detection
• Enable SMS filtering in the default messaging app
• Turn on biometric authentication for all banking and UPI apps
• Set up transaction alerts via SMS for all bank accounts
• Disable "install from unknown sources" in settings
• Remove any remote access apps (AnyDesk, TeamViewer) unless they're really needed
• Set a screen lock timeout of 30 seconds or less

Create a family rule. "If any message asks you to click a link, update KYC or verify anything, call me before you do anything." Keep it that simple so it becomes automatic, and stick it on a note next to their phone if you have to. Strange message, call a family member, touch nothing until you've talked. That one habit would have stopped the PAN scam at the top of this post, and probably most of the scams people hear about from friends and relatives.

Block remote access abuse. Some scammers talk people into installing AnyDesk or TeamViewer for "tech support." Tell your parents plainly that no bank or company will ever ask them to install screen-sharing software. If you can, use parental controls to block installs of unknown apps.

Set UPI limits. Most UPI apps let you cap per-transaction and daily amounts. For elderly family members, pick something sensible, say Rs 5,000 per transaction and Rs 20,000 per day, so that if a scam does get through, the damage stays limited.

How to set up 2FA on the accounts that matter most

Google account: myaccount.google.com/security → "2-Step Verification." You can use Google Prompts (tap "Yes" on your phone, the easiest), an authenticator app (Google Authenticator or Authy, which I recommend), or a hardware security key like YubiKey (the most secure).

WhatsApp: Settings → Account → Two-step verification → set a 6-digit PIN and add a recovery email. This stops someone who clones your SIM from taking over your account.

UPI apps (PhonePe/Google Pay): UPI already has 2FA built in, through device binding plus your PIN. On top of that, turn on app lock (biometric or PIN) and login alerts for new devices, and every so often review your linked bank accounts and remove the ones you don't use.

Email (Outlook/Yahoo/other): Most providers support 2FA through authenticator apps. Turn it on for every email account, starting with the one tied to your bank and government portals, because whoever gets into your email can reset the password on everything else.

Social media (Instagram, Facebook, Twitter): All of them support 2FA through authenticator apps, so turn it on. These accounts get hacked more often than people realise, and a hijacked Instagram or Facebook profile can be used to scam your friends and family while pretending to be you.

On authenticator apps vs. SMS: pick the authenticator app whenever it's offered. SMS OTPs can be intercepted through SIM swap attacks, where a scammer convinces your telecom provider to move your number to their SIM. This happens in India more often than you'd think. It gets straight past SMS-based verification. Authenticator apps generate codes on your own device, so a SIM swap doesn't touch them.

Inside the scam operation

Knowing how these operations run makes them easier to recognise. Most phishing campaigns hitting Indians are organised, almost industrial, rather than one person in a room.

Phishing kits sell on Telegram channels and dark web marketplaces for Rs 2,000-5,000. A kit bundles cloned bank website templates, hosting scripts, SMS/email blasters, a backend that collects credentials, and instructions for using money mules. Your own data may already be sitting in those same markets, so it's a good idea to check if your info has been exposed on the dark web.

Getting started is shockingly cheap. Someone with basic technical skills can buy a kit, put it on a cheap hosting provider, buy a list of phone numbers and start sending messages, all within a few hours and for less than Rs 10,000 in total. A small campaign aimed at a few thousand people can net lakhs if a handful of them enter their banking credentials.

The money chain moves fast. Victim enters credentials on fake site → data reaches the scammer in real time (often via a Telegram bot) → scammer logs into the real bank account immediately → money goes to mule accounts (opened with fake or stolen identities) → mule withdraws cash (keeps a cut) → cash gets converted to cryptocurrency. All of that can happen within minutes of you typing your password.

The mule accounts deserve a closer look. Scammers recruit people, often college students or people in money trouble, to open bank accounts in their own names and let the scammers route money through them. The mule gets a commission (usually 5-10%) and assumes it's harmless work. It's money laundering. When the police trace the funds, the mule is usually the first one caught. If anyone asks to use your bank account for "business transactions" in exchange for a commission, they're trying to recruit you as a mule.

Where to report

Report even if you doubt anything will come of it, because each report adds to a pattern that helps the authorities find and shut down scam operations. The 1930 helpline in particular has improved at freezing transactions in progress, since it works directly with banks to put holds on suspected fraud. Call early.

The habits that keep you safe

Phishing will keep improving. AI-generated content is making fake messages harder to tell apart from real ones, and deepfake voice calls are a real threat now. Scammers can clone a voice from a few seconds of audio, so you could get a call that sounds exactly like your son or daughter asking for an urgent transfer. Our cybersecurity best practices guide covers the wider set of habits for staying safe online. The basics below still hold.

Don't trust links in messages. Open the official site or app yourself, and type the URL by hand if you have to. Slow down, too: scammers manufacture urgency because rushed people make mistakes, so whenever a message says "within 24 hours," "immediately" or "your account will be blocked," give it 60 seconds before you act. Never share your UPI PIN, OTP or CVV with anyone, for any reason; no bank employee, customer service rep or police officer will legitimately ask for them. Keep your software updated, since security patches close the holes scammers crawl through. And talk to your family. Staying safe is a household job.

Get into the habit of doubting every unsolicited message, practically rather than paranoidly. If something you weren't expecting asks for money, personal details or a click, treat it as suspicious until you've checked it properly. That one default would stop most phishing attacks that succeed today.

Think back to that retired principal, one field away from handing her Aadhaar number to a stranger. That's how close and how easy it is. If you've read this far, show it to someone you worry about.