Modern phishing in India is often less about a badly written email and more about urgency plus impersonation. The attacker may pretend to be a bank, courier, police officer, customer-care agent, employer or family member and try to move the conversation onto a payment, OTP, screen-sharing or remote-access step.
Five patterns worth recognising
1. “Your KYC/account will be blocked”
The message creates a deadline and gives you a link or phone number. The safer response is to ignore the link and open the bank or service through its official app/site.
2. Fake customer care
A user searches for support, calls an unofficial number and is asked to install a remote-access app, share an OTP or make a “verification” payment. Start from the company’s own website or app instead.
3. UPI refund or collect-request fraud
The attacker claims you must approve a request or enter a UPI PIN to receive money. A PIN authorises a debit; do not approve an unexpected collect request.
4. Digital-arrest impersonation
A caller claims to be police, customs, CBI, TRAI or another authority, insists you stay on video, threatens secrecy and demands money for “verification” or “safe custody.” End the call and independently verify through official channels.
5. Job/task scams
A supposed job starts with small paid tasks, then requires the victim to deposit money to unlock commissions or withdraw a balance. A job that requires repeated deposits to get paid is a major warning sign.
The 60-second verification rule
- Stop the conversation without clicking or paying.
- Open the organisation’s official app/site yourself.
- Use the phone number published there, not the number in the message or search result.
- Ask whether the request really exists on your account.
If you already paid or shared credentials
Contact the bank/payment provider immediately, call 1930, file at cybercrime.gov.in, preserve evidence and change affected credentials from a trusted device. If remote-access software was installed, remove it and review device/account access.
Editorial basis
This guide describes common fraud patterns; it does not claim that every scam uses the same script or that any response guarantees recovery.