What Is a Phishing Link? ** A phishing link is a URL crafted to impersonate a legitimate website — a bank, government portal, courier service, or e-commerce platform — in order to trick the recipient into entering sensitive information. Unlike UPI fraud, which relies on manipulating a payment app, phishing usually targets login credentials, card details, or one-time passwords through a fake web page that looks nearly identical to the real one. Phishing links most commonly arrive through SMS (often called "smishing"), WhatsApp messages, and email, and are built to be opened quickly on a mobile screen where small inconsistencies are easy to miss. 8 Signals That Separate a Real Link From a Phishing Link** 1. Mismatched or Misspelled Domain The single most reliable signal. A real bank uses its own domain — for example, a genuine HDFC Bank page will only ever appear under hdfcbank.com. A link like hdfc-bank-verify.tk or hdfcbank.security-update.info is not the same domain, regardless of how convincing the rest of the page looks. 2. Urgency and Fear Tactics Phishing messages are written to short-circuit careful reading: "Your account will be blocked in 2 hours," "Unusual activity detected — verify now," or "Your electricity will be disconnected tonight." Legitimate institutions rarely create this kind of time pressure through SMS or email links. 3. Generic Greetings Real banks and services that already have your account details typically address you by name. A message starting with "Dear Customer" or "Dear User" instead of your actual name is a common sign of a mass-sent phishing attempt. 4. Suspicious Sender Address On email, check the full sender address, not just the display name. A message that displays as "State Bank of India" but comes from a random Gmail or unrelated domain address is not legitimate, no matter how official the display name looks. 5. Shortened or Masked URLs Link shorteners (like bit.ly or tinyurl) hide the actual destination, which makes them a common phishing tool. Be cautious of any shortened link in an unsolicited message, especially one tied to banking, deliveries, or payments. 6. Unexpected Attachments An unexpected invoice, "delivery form," or document attached to an unsolicited message can carry a phishing link or malicious file embedded inside it, even if the email text looks harmless. 7. Requests for OTP, PIN, or Password No legitimate bank, government body, or courier service will ever ask you to share an OTP, PIN, CVV, or password by clicking a link and logging in through it. This is the clearest and most consistent signal across nearly all phishing attempts. 8. No HTTPS or a Fake Padlock A missing padlock icon or a URL starting with "http" instead of "https" is a warning sign, though not proof by itself — some phishing pages now also use HTTPS. Treat the padlock as one signal among several, not a guarantee of safety.** How to Check a Link Safely**
- On mobile or desktop, press and hold (or hover over) a link to preview the actual destination URL before tapping it.
- Compare the domain character by character against the organization's known official website.
- If in doubt, don't click the link at all — open the official app or type the known website address directly into your browser.
- Never enter an OTP, PIN, or password on a page you reached by clicking a link from an SMS, WhatsApp message, or email.** Real-World Examples in India** Fake bank SMS: A message claiming to be from a bank states that a debit card has been "temporarily blocked" and includes a link to a page mimicking the bank's net-banking login, designed to capture the username and password entered. Fake courier or customs fee: A text claims a package is held at customs and asks for a small "clearance fee" to be paid by clicking a link, which leads to a fake payment page that captures card details. Fake electricity disconnection notice: A message warns that electricity service will be disconnected that night unless an outstanding bill is paid immediately through a linked page, pressuring quick action without verification.** Frequently Asked Questions** How can I tell if a shortened link is safe to open? You generally can't tell just by looking at it. Use a link-expander tool to preview the destination first, or avoid shortened links entirely in unsolicited messages, especially ones related to banking or payments. Can a phishing link infect my phone just by opening it? Simply opening a link is usually safe on modern phones and browsers, but entering information on the resulting page — or downloading an attached file or app — is where the actual damage happens. Do phishing links only come through email? No. In India, SMS and WhatsApp are now the most common channels for phishing links, often disguised as bank alerts, delivery notifications, or government messages. What should I do if I've already entered my details on a phishing page? Immediately change the password for that account, contact your bank to freeze the card or account if financial details were entered, and report the incident at cybercrime.gov.in or by calling 1930. Is a padlock icon proof that a website is safe? No. A padlock only confirms the connection is encrypted, not that the website itself is legitimate — many phishing pages now also use HTTPS. Always verify the domain name itself, not just the padlock.