A phishing SMS does not succeed because it is well written. Most are not. It succeeds because it arrives at a plausible moment, says something true enough to pass a glance, and asks for one small action. You registered somewhere yesterday, so a verification message makes sense. A payment failed last week, so a refund notice is credible. The craft is in the timing rather than the text, which is why advice to look for spelling mistakes is weak protection. The eight signs below work regardless of how polished the message is, and two of them settle the question on their own.
Table of Contents
Why a phishing SMS works at all
Text messages carry an authority that email lost years ago. They arrive on the lock screen, they are short, and most people still associate them with banks and delivery firms rather than with fraud.
They are also read quickly, usually while doing something else, which is the condition the whole attack depends on. A message that would not survive thirty seconds of attention does not need to, because it is designed to be acted on in five.
The numbers game underneath
Messages go out in bulk to numbers from leaked lists. The sender does not know whether you hold the account mentioned, and does not need to. Out of a hundred thousand recipients, enough will have registered somewhere recently that the message lands as a coincidence rather than a cold approach.
The eight signs
Any one of these justifies deleting the message. The last two are conclusive on their own.
- Urgency with a deadline. Account suspended in two hours, verify now, final notice. Real organisations rarely impose minutes.
- A shortened or unfamiliar link. Legitimate senders generally use their own recognisable domain.
- Sent from an ordinary mobile number. Businesses send from registered sender IDs, not personal handsets.
- A greeting with no name, or the wrong name. Bulk sending shows here.
- An offer that does not match anything you did. A refund for a purchase you never made is not a windfall.
- Slightly wrong branding. A spacing error in a company name, an extra hyphen in a domain.
- A request for an OTP. Conclusive. Nobody legitimate asks.
- A request for a PIN, password or card details. Conclusive, always.
Notice that only one of the eight is about writing quality. Attackers using proper grammar and correct branding still have to ask for something, and the asking is where they remain visible.
Reading the sender properly
In India, commercial messages arrive from a registered six-character sender ID rather than a phone number. Something like AX-HDFCBK rather than a ten-digit mobile. That is a genuine signal and it is worth learning to read.
A message claiming to be from a bank or a large platform that arrives from a personal mobile number is wrong before you read a word of it. The reverse, unfortunately, is not proof of anything: sender IDs can be registered by anyone able to complete the paperwork, and lookalike IDs do appear.
The other detail worth noticing is threading. Messages from a real sender ID group together in one conversation. If a supposed bank message appears in a new thread separate from the ones you have received before, something has changed, and it is not usually the bank.
Links, shorteners and lookalike addresses
The link is the payload, and it is the part most worth refusing to engage with at all.
Shorteners are the clearest warning. They exist to hide a destination, and while they have legitimate uses, a message about your money has no reason to conceal where it is sending you. Treat any shortened link in a financial or account context as hostile.
Lookalike domains are subtler. A doubled letter, a hyphen inserted into a brand name, a different extension on the end. On a phone the address bar truncates, so the deceptive part is frequently the part you cannot see.
The reliable habit costs nothing: never reach an account through a link in a message. Open the app you already have, or type the address yourself. If the message was genuine, whatever it refers to will be visible inside the account anyway, and if it was not, you have lost ten seconds.
The two things nobody genuine asks for
If everything else on this page were forgotten, these two would still prevent most losses.
A one-time password. It exists to prove the phone is in your hands. Sharing it hands over exactly the thing it was designed to protect. No support agent, no verification team and no bank officer needs it, because they can see the account without it. A request for an OTP is an attack, with no exceptions worth considering.
A UPI PIN. This one is widely misunderstood and the misunderstanding is expensive. A UPI PIN authorises money leaving your account. It is never required to receive anything. Any message or caller explaining that you must enter your PIN to accept a refund, claim a prize or receive a payment is arranging for you to send money, and the screen will say so if read carefully.
That second point is the single most common mechanism behind refund fraud in India, and it works because the request sounds procedural rather than alarming.
The refund message, and why it is so effective
Of all the variants, the refund message deserves separate treatment because it inverts the victim’s guard. Most fraud asks you to pay; this one appears to be paying you.
The sequence is consistent. A message says a refund is pending. A link or a call follows, with a form or an app request. At the final step you are asked to approve a collect request or enter your PIN to receive the money, and approving it sends the amount out rather than bringing it in.
- Receiving money through UPI never requires your PIN
- A collect request asks you to pay, even when it is labelled as a refund
- Genuine refunds return to the original payment method automatically
- Read the amount and direction on the confirmation screen before approving anything
Our wider list of warning signs across gaming and payment scams covers the related approaches, several of which begin with exactly this kind of message.
If you already tapped the link
Tapping alone is usually survivable. What matters is what happened next, and acting quickly keeps the list short.
If you only opened the page and typed nothing, close it, and do not go back to check. If you entered a password, change it immediately on the real site, and change it anywhere else that password is used. If you entered card details, call your bank and have the card blocked. If you shared an OTP, treat the account as compromised now rather than waiting to see.
If you installed anything the page offered, that is the serious case. An app arriving via a link in a text message, particularly one requesting accessibility permissions or the ability to read messages, should be removed at once, and the device checked properly afterwards.
In every version, screenshots first. The message, the sender, the link, the time. A complaint made later is assessed on what you can produce, and the evidence disappears the moment you tidy up.
Reporting it, and why it is worth the minute
Most people delete and move on, which is understandable and leaves the number running. Reporting takes under a minute and has a measurable effect, because bulk senders are shut down on volume of complaints rather than on individual cases.
On both Android and iPhone, the messaging app offers a report-as-spam option that forwards the sender and content to the operator. India also operates a dedicated channel for reporting unsolicited commercial messages, and banks maintain their own reporting addresses for messages impersonating them.
Where money has actually moved, speed matters far more than completeness. Contact your bank the same day, raise the transaction dispute formally rather than verbally, and keep the reference number. Recovery rates fall sharply after the first twenty-four hours, and the single most common reason a claim fails is that it was reported a week later by someone who hoped it would resolve itself.
One habit worth building afterwards: tell someone. Fraud of this kind depends on embarrassment to stay quiet, and the variants circulating in a household or a workplace tend to arrive in clusters. A message mentioned over dinner has stopped more second victims than any amount of published advice.
The call that follows the message
A phishing SMS is often only the first half. The second half is a phone call a few minutes later, and the combination is far more effective than either part alone.
The sequence works because the message creates a worry and the call offers to resolve it. Somebody calling about a problem you have just read about does not feel like a cold approach; it feels like service. The caller is usually calm, slightly bored, and in no apparent hurry, which is the opposite of what people expect a fraudster to sound like and is precisely why it works.
The tell is the same as everywhere else on this page: at some point the conversation requires something only you can provide. A code read aloud, a PIN entered, an app installed so they can see your screen. Everything before that is scaffolding.
- Hang up and call back on a number you found yourself, never one you were given
- A genuine agent will accept that without argument; pressure not to hang up is the signal
- Never install a screen-sharing or remote-support app at a caller’s request
- Being told the call is about protecting your account does not change any of the above
The screen-sharing request deserves emphasis. Remote access tools are legitimate software used by real support teams, which is exactly why they are effective here. Once installed at a stranger’s direction, they can watch every credential typed and operate banking apps directly, and no amount of caution afterwards compensates for it.
One closing thought on why this advice keeps needing repeating. Phishing by text persists because it is cheap, legal to attempt until someone is defrauded, and effective at a rate of well under one per cent. A campaign reaching a hundred thousand numbers only needs a handful of people reading quickly on a crowded train. Slowing down for ten seconds before tapping anything is, unglamorously, the entire defence.
Frequently Asked Questions
How can I tell a phishing SMS from a real one?
Judge it by what it asks rather than how it reads. Requests for an OTP, a PIN, a password or card details are conclusive. Shortened links, artificial deadlines and messages arriving from a personal mobile number rather than a registered sender ID are all strong indicators.
Is it dangerous just to open a text message?
Opening and reading a message is effectively safe. The risk comes from tapping the link, entering details on the page it opens, installing anything it offers, or replying with a code. If you only read it, delete it and move on.
Why do these messages mention something I actually did?
Usually coincidence at scale. Messages go out in bulk to leaked number lists, and out of a very large batch a meaningful fraction of recipients will have registered somewhere or made a payment recently. It feels targeted and almost never is.
Does a UPI PIN ever need to be entered to receive money?
No, never. A PIN authorises money leaving your account. Any instruction to enter one in order to receive a refund, prize or payment is arranging an outgoing transfer, and the confirmation screen will show the amount leaving if you read it before approving.
What should I do if I shared an OTP?
Treat the account as compromised straight away rather than waiting. Change the password from a device you trust, end all active sessions, remove any saved payment method, and contact the platform through its published channel. If money moved, raise it with your bank the same day.