How to Recognise Phishing Emails and Messages: 10 Warning Signs

Phishing is one of the most common ways criminals steal passwords, money and personal data. A phishing email or message pretends to be from a trusted organisation to trick you into clicking a link, opening an attachment or sharing information. Learning the warning signs can protect you and your family. Here is how to recognise phishing emails.

Key Takeaways

Phishing messages create urgency or fear to rush you.
Check sender addresses and links carefully before clicking.
Legitimate organisations do not ask for passwords, OTPs or PINs.
If in doubt, contact the organisation through its official website or app.

10 Warning Signs

Urgent or threatening language: “Your account will be blocked today.”
Unexpected messages: about prizes, refunds or parcels you did not expect.
Suspicious sender address: a display name that looks real but an odd email domain.
Mismatched links: hovering shows a different web address than the text.
Requests for sensitive information: passwords, OTPs, card details.
Generic greetings: “Dear Customer” instead of your name.
Spelling and grammar mistakes.
Unexpected attachments: especially .zip, .exe or macro-enabled files.
Too-good-to-be-true offers: huge discounts, lottery wins.
Look-alike websites: small changes in the domain name.

Common Phishing Examples

Message	Red Flag
“Your KYC has expired, update now via this link”	Banks do not ask for KYC via random links
“Your parcel is on hold, pay ₹25 fee”	Unexpected small payment request
“Electricity will be disconnected tonight, call this number”	Urgency and unofficial phone number
“You won a gift card, enter card details”	Prize you never entered for

Phishing Beyond Email

Phishing also comes through SMS (smishing), phone calls (vishing), social media messages and fake ads. The same rules apply: verify before you trust.

What to Do If You Clicked

Disconnect from the internet if you downloaded something suspicious.
Change passwords for affected accounts from a safe device.
Enable two-factor authentication.
Contact your bank immediately if financial details were shared.
Report to the cybercrime helpline 1930 or cybercrime.gov.in.
Run a security scan on your device.

How to Report Phishing

Use your email provider’s “Report phishing” option.
Report fraudulent SMS or calls through the government’s Sanchar Saathi Chakshu facility.
Report cybercrime at cybercrime.gov.in.

How to Inspect an Email Safely

Check the sender’s full email address, not just the display name.
Hover over links (on computer) to see the real destination.
Look at the domain carefully: “rnicrosoft” instead of “microsoft,” extra words or unusual extensions.
Do not download unexpected attachments.
Contact the organisation through its official website or app if unsure.

Real-World Phishing Scenarios

Scenario	How It Tricks You	Safe Response
“Your electricity will be cut tonight”	Fear and urgency	Check with your electricity provider’s official app or number
“Income tax refund pending, click to claim”	Promise of money	Log in only via the official income tax portal
“Your parcel address is incomplete”	Curiosity about deliveries	Track orders through the official courier or shopping app
“HR policy update: log in to view”	Workplace trust	Verify with your HR through internal channels
“Job offer, pay a registration fee”	Hope for employment	Genuine employers do not charge fees

Spear Phishing and Business Email Compromise

Some attacks target specific people using personal details found online. Attackers may impersonate a senior executive asking finance staff to transfer money urgently, or a vendor asking to change bank details. Always verify such requests by calling a known number, not the one in the email.

Teaching Family Members

Older adults and children are often targeted. Share simple rules: never share OTPs, never click links in unexpected messages, and always ask a trusted family member before acting on urgent requests involving money.

Technical Protections

Enable spam and phishing filters in your email service.
Use two-factor authentication to limit damage if a password is stolen.
Keep browsers updated for built-in phishing warnings.
Use a password manager, which will not autofill on fake sites.

Remember

Phishing succeeds by creating urgency. When in doubt, pause, verify independently and never act on the message itself.

Common Phishing Traps to Watch For

Urgent account warnings: Messages saying your account will be closed today are designed to rush you.
Look-alike sender addresses: Scammers use addresses that look similar to real companies. Check carefully.
Unexpected attachments: Invoices or documents you did not expect may contain malware.
Requests for OTPs or passwords: Genuine organisations never ask for these by email.
Links that do not match the site: Hover over links to see the real destination before clicking.

When in doubt, go directly to the official website or app instead of clicking email links.

Frequently Asked Questions

What is phishing?

A scam where criminals pretend to be trusted organisations to steal information or money.

Can opening a phishing email harm me?

Opening is usually low risk, but clicking links, downloading attachments or entering details can be dangerous.

How can I check a link safely?

Hover over it on a computer or long-press on mobile to preview the address, and type official addresses yourself.

Do banks send links by SMS?

Banks may send informational messages, but never ask for OTPs, PINs or passwords. Use the official app when in doubt.

Where do I report phishing in India?

Call 1930 or report at cybercrime.gov.in, and use Sanchar Saathi for suspicious calls and messages.

Conclusion

Phishing works when people act quickly without checking. Slow down, look for warning signs, verify through official channels and report suspicious messages. A few seconds of caution can prevent serious loss.