Phishing

Phishing is any fake message, email or website built to look real so you hand over sensitive details like a password, OTP or card number. The classic sign is a link with urgency, such as a KYC or account-blocked warning.

How phishing works

A phishing attempt impersonates someone you trust: your bank, a delivery company, the tax department, a wallet. The message creates pressure, “your account will be blocked”, “your KYC expires today”, “claim your refund now”, and gives you a link. The link leads to a page that looks exactly like the real one, but anything you type, your password, card number or the OTP sent to your phone, goes straight to the scammer. With those details they drain the account or make purchases.

The tell-tale signs

Urgency is the biggest red flag: real institutions rarely demand instant action through a link. Others include a slightly wrong web address, spelling mistakes, a request for an OTP or PIN (which no genuine staff member ever needs), and messages from an unknown number claiming to be your bank. A refund or prize you did not expect is almost always bait.

The one habit that defeats it

Never act on the link. If a message worries you, ignore its link entirely and open the official app, type the website address yourself, or call the number printed on your card. That single habit neutralises almost every phishing attempt, because the scam depends on you using their link. Learn more in protect yourself from online fraud.