Phishing in India: Fake Emails, Cloned Bank Sites & the Links That Steal Everything
The email looks exactly like your bank sent it. The website has a padlock. You log in — and watch your account emptied before you reach the dashboard. Phishing is the most common first step in nearly every major cyber fraud in India. Here's what it looks like, how it works, and how to spot it every single time.
What Is Phishing — and Why Is It So Effective in India?
Phishing is deception at scale. The attacker doesn't need to break into your bank's servers. They just need to trick you into handing over your credentials yourself — and then use those credentials to walk through the front door of your account.
India is the third most phished country in the world. The reasons are interconnected: a massive new internet user base, high trust in official communications, widespread use of mobile banking, and enormous volumes of personal data circulating from past breaches — all of which make convincing, personalised phishing messages easier to construct.
What makes phishing uniquely dangerous is that it doesn't require a technical vulnerability. It exploits human psychology — urgency, authority, fear, and the reasonable assumption that an email displaying your bank's logo came from your bank.
The HTTPS Padlock Myth — India's Biggest Phishing Misconception
When HTTPS and the padlock icon became widely known as signs of a "safe" website, phishing operators immediately obtained free SSL certificates for their fake domains. Today, over 83% of phishing sites use HTTPS.
8 Types of Phishing Attacks Targeting Indians
The delivery method changes — email, SMS, WhatsApp, QR code, search ads — but every phishing attack has the same goal: your credentials or your money.
Email Phishing
Mass-sent fake emails impersonating SBI, HDFC, Income Tax, Amazon, or IRCTC. A convincing clone of the official template leads you to a fake site that harvests your credentials.
Smishing (SMS Phishing)
SMS messages with urgent links — 'Your SIM will be blocked in 24 hours', 'KYC pending — click to verify', 'Package held at customs'. The link leads to a credential-harvesting page.
WhatsApp / Telegram Phishing
Fake job offers, lottery wins, or government scheme links sent via WhatsApp. Often designed to look like forwarded messages from trusted contacts whose accounts were compromised.
Website Spoofing
Pixel-perfect clones of bank portals, income tax login pages, and e-commerce checkout flows. Domains use subtle misspellings or confusable characters — sblnkng.com vs sbinking.com.
QR Code Phishing (Quishing)
Physical QR codes on posters, parking meters, ATM fascias, or restaurant menus pasted over legitimate codes — redirect to phishing sites that steal card details or UPI credentials.
Search Engine Phishing
Fraudsters pay for Google Ads targeting searches like 'SBI bank login', 'IRCTC customer care number'. The top sponsored result is a fake site or a number that connects to a scam call centre.
Spear Phishing
Highly targeted attacks using your name, role, company, and recent activity — often scraped from LinkedIn or data breaches. An attacker poses as your IT department, CEO, or a vendor.
Malicious Attachment Phishing
Emails carrying Word documents, PDFs, or APK files that install keyloggers or RATs when opened. Common pretexts: 'invoice attached', 'your statement', 'job application form enclosed'.
How a Bank Phishing Attack Unfolds — Minute by Minute
Reading this sequence once makes it nearly impossible to fall for the same attack. The deception only works if you don't see the pattern in advance.
The Lure Arrives
An email arrives from 'noreply@sbi-netbanking-alert.com'. The subject: 'URGENT: Suspicious login detected — verify your account immediately or it will be suspended in 24 hours.' The SBI logo, colours, and footer are indistinguishable from real SBI communications.
You Click the Link
The embedded 'Verify Now' button sends you to https://sbi-secure-login.netbankingverify.com — a page that looks exactly like the real SBI login screen. The address bar shows a padlock (HTTPS) which most users interpret as proof of safety.
You Enter Your Credentials
POINT OF NO RETURNUsername, password, date of birth, and account number — entered into a form that looks real but submits data directly to the attacker. Each keystroke is logged and stored in a database accessible from anywhere in the world.
The OTP Screen Appears
POINT OF NO RETURNAfter submitting credentials, a convincing 'OTP verification' screen appears. Meanwhile, the attacker is already logging into the real SBI with your credentials — triggering the genuine OTP to be sent to your phone. You enter it on the fake screen.
Redirect to Real Site — You Suspect Nothing
After the OTP, the page shows 'Verification successful — redirecting…' and sends you to the real SBI website. You're now logged into your real account. Everything looks normal. The attacker, in another window, has just transferred your balance.
Discovery — Too Late
You check your balance the next morning. Multiple transfers you didn't authorise. The fake site is gone — the domain was registered 48 hours ago and hosted in a jurisdiction with no extradition. The credentials database has been sold.
"It Said 'Income Tax Refund of ₹18,340 Pending'. I Just Had to Verify My Details." — A Real Account
Deepak (name changed), a 38-year-old software engineer from Bengaluru, received an SMS that correctly referenced his name and the financial year. It informed him that a refund of ₹18,340 from the Income Tax Department was pending and could not be processed because his bank account details were 'not updated' in the IT portal.
The link in the SMS took him to a page that looked exactly like the official incometax.gov.in portal. It had the correct logo, the correct colour scheme, and a reassuring padlock in the address bar. The URL was: incometaxefilng.gov.in-refund.claim-now.net
He entered his PAN, date of birth, and net banking login details. The site then asked for his debit card number, expiry, and CVV to 'confirm the bank account' for the refund transfer. He provided them. Then an OTP arrived. He entered it on the site's 'verification' screen.
Within 11 minutes, ₹96,000 was withdrawn from his savings account across two transactions — ₹49,900 and ₹46,100 (kept below ₹50,000 to avoid certain bank alert thresholds). His net banking account password had also been changed, locking him out.
When he visited the real incometax.gov.in, he saw an official notice: "The Income Tax Department does not send refund links via SMS. Do not click on any link claiming to be from the IT Department." The notice had been there for two years. He had simply never seen it.
The URL Check That Would Have Saved ₹96,000:
The real domain was incometax.gov.in. The phishing URL was incometaxefilng.gov.in-refund.claim-now.net — a completely different domain (claim-now.net) with the official-looking text as a subdomain prefix. Read URLs from right to left: the last segment before the first slash is always the real domain.
How to Read a URL — The Single Most Valuable Anti-Phishing Skill
Every phishing site has one unavoidable weakness: it cannot use the real domain of the organisation it's impersonating. That domain is owned by the real organisation. So phishers construct look-alike URLs designed to fool you if you don't know how domain names work.
The one rule that overrides everything else: the real domain is always the segment immediately to the left of the first single slash in the URL. Everything to its left is a subdomain (which anyone can set) and everything to the right is a path.
Read URLs right to left from the first `/`. The last hostname segment is your ground truth. If it doesn't exactly match the organisation's known domain, you're on a phishing site — regardless of how official everything else looks.
sbi.co.in/loginReal domain: sbi.co.in — Legitimate SBI login
sbi.co.in.secure-login.net/loginReal domain: secure-login.net — Phishing — real domain is secure-login.net
login.sbi-netbanking.co/accountReal domain: sbi-netbanking.co — Phishing — not the same as sbi.co.in
incometax.gov.in/efileReal domain: incometax.gov.in — Legitimate Income Tax portal
incometaxefilng.gov.in-refund.claim-now.netReal domain: claim-now.net — Phishing — .gov.in is just a subdomain here
QR Code Phishing (Quishing) — The Scam Indians Don't See Coming
QR codes are now everywhere in India — on restaurant menus, at petrol pumps, on municipal utility bills, at temples, and at parking metres. The vast majority are legitimate. But QR code fraud is growing rapidly because it bypasses the one habit many people have formed: not clicking suspicious links.
Physical sticker QR codes can be pasted over legitimate ones in seconds. A fraudulent code pasted over a restaurant's menu QR or a parking payment point will lead to a fake payment processor that either captures your UPI credentials or initiates a payment to a fraudster's account.
Email and WhatsApp QR phishing bypasses many secure email gateways that scan for suspicious links — because the link is encoded inside an image, invisible to text-based scanners.
How to Stay Safe Around QR Codes
- Before scanning, check whether the QR sticker is on top of another printed QR — peel edges visible are a red flag
- After scanning, read the full URL before tapping 'Open' — apply the same domain verification rules
- QR codes for UPI payments should only go to official payment apps — not browser-based payment pages
- Never scan a QR code sent via email, WhatsApp, or SMS claiming to be from a bank, TRAI, or government
- Use a QR scanner app that shows you the URL before opening it, rather than auto-opening
- If a QR code redirects you to enter a password or OTP, close immediately — legitimate QR payments never require these
10 Red Flags of a Phishing Email or Message
Any single one should stop you before you click.
Sender email domain is slightly wrong — sbi@sbi-alert.co, hdfc@hdfcbankalert.net, incometax@it-refund.in
Extreme urgency — 'Your account will be blocked in 24/48 hours unless you act immediately'
Link destination doesn't match the sender's claimed organisation when you hover before clicking
The page uses HTTP (no padlock) OR has a padlock but the domain name is wrong — HTTPS ≠ legitimate
Request for information the organisation already has — your date of birth, full card number, or Aadhaar
Poor grammar, odd spacing, inconsistent fonts, or slightly wrong logo colours in the email
A government body (TRAI, IT Department, RBI) is requesting payment or personal data via email or SMS
Email has an attachment you weren't expecting — always suspicious even from known senders
The email was not addressed to you by name — 'Dear Customer' or 'Dear User' instead of your name
Promised refund, cashback, or reward that requires you to 'verify' payment details to receive it
Phishing Myths vs. Reality
Myth
I can always spot a phishing email — they're full of typos and bad English.
Reality
Modern phishing emails targeting Indians are crafted in fluent, formal Hindi and English, use the exact fonts and colours of the brand they impersonate, and personalise with your name and partial account details from breach databases. The 'obvious typo' era of phishing ended years ago.
Myth
The site is safe because it has HTTPS and a padlock.
Reality
HTTPS only means the connection to that server is encrypted. It says nothing about whether the server itself belongs to a legitimate organisation. Over 83% of phishing sites now use HTTPS. The padlock is not a safety seal.
Myth
Only uneducated or elderly people fall for phishing.
Reality
CERT-In data consistently shows that IT professionals, bankers, and engineers are among the most common phishing victims in India — because they are less likely to pause and question what they assume to be routine digital communications.
Myth
I use antivirus so my device will warn me if a site is fake.
Reality
New phishing domains are registered in minutes — often faster than antivirus databases can update. A phishing site created in the last few hours will pass most real-time checks. The final defence is always your own URL verification, not software.
Fell for a Phishing Attack? Do This Immediately.
Speed is critical. A compromised password or OTP can be used within seconds.
Do not click — close the page immediately
DO FIRSTIf you caught it before entering anything: close the browser tab, do not go back, and mark the email as phishing. Do not forward the message to others 'to warn them' — this spreads the link further.
Change your password immediately from a clean device
DO FIRSTIf you entered credentials: change the password on the affected account right away using a different device or network. Prioritise email and banking accounts as attackers use email access to reset everything else.
Contact your bank if financial credentials were shared
Call your bank on the official number (back of card or official website only). Report the phishing and request a temporary block on net banking and card transactions. A fraud report number will be provided.
Call 1930 if a transaction has occurred
India's Cyber Crime Financial Fraud Helpline can attempt to freeze destination accounts within the first 30–60 minutes of a transfer. Have your transaction reference ready.
Report the phishing site at cybercrime.gov.in
Submit the fake URL, a screenshot of the email or message, and any transaction details. The National Cyber Crime Reporting Portal coordinates with hosting providers and domain registrars for takedowns.
Enable two-factor authentication on all accounts
After recovering access, enable 2FA on your banking apps, email, and social accounts. Even if a future phishing attempt steals your password, 2FA prevents login without the second factor.
Report Phishing — Official Channels
Use these to report phishing attempts and recover from attacks
National Cyber Crime Portal
cybercrime.gov.in
Report phishing URLs, fake websites, and credential theft with evidence
Cyber Crime Helpline
1930
Call immediately if money was transferred — account freeze window is 30–60 minutes
CERT-In Incident Reporting
cert-in.org.in
Report phishing emails and fake websites to India's Computer Emergency Response Team
Google Safe Browsing Report
safebrowsing.google.com/safebrowsing/report_phish
Report phishing URLs to Google — helps block the site for billions of Chrome and Android users
Check a URL — VirusTotal
virustotal.com
Scan any suspicious URL against 70+ security engines before clicking
Check a Website — RakshaAI
rakshaai.co/website-safety-checker
Verify any Indian website or link against RakshaAI's fraud database before you interact with it
Frequently Asked Questions
Straight answers to the most common phishing questions in India.
What is phishing?
What does a phishing email look like in India?
How do I check if a link is a phishing link?
What is smishing?
Can I get hacked just by opening a phishing email?
What should I do if I clicked a phishing link?
Suspicious Link or Email?
Check It Before You Click.
Paste any suspicious URL into RakshaAI's website checker before opening it. Or report a phishing attempt you've already received — your report helps protect millions of other Indians from the same fake site.
🇮🇳 Protecting 2M+ Indians from phishing & online fraud · 100% Free · No registration required