What is phishing, and how does it work?

Phishing is when someone pretends to be a person or a company you trust so that you do something you would not normally do. You tap a link, open a file, share a password or an OTP, or send money.

It is one of the most common ways people lose money and accounts online, and it does not need clever hacking. It only needs you to believe a message for a few seconds. This guide explains how phishing works, the different forms it takes, how to spot it, and what to do if you have already slipped.

How a phishing attack works

Almost every phishing attack follows the same four steps.

1. The bait. A message that looks like it comes from your bank, a courier, a government office, your manager or a friend.
2. The pressure. “Your account will be blocked today.” “Your parcel is on hold.” “Last chance to claim.” The rush is deliberate. It stops you from checking.
3. The action. A link to a fake page, a file to open, a phone number to call, or a QR code to scan.
4. The payoff. Your password, card details, OTP or UPI PIN. Sometimes the money itself. Sometimes software that is quietly installed on your phone or computer.

The details change every week, but the shape does not. Once you can see the shape, you can recognise new versions of the same trick.

Phishing, scams and malware: what is the difference?

People use these words loosely, so it helps to separate them.

• A scam is any trick to get your money or personal details.
• Phishing is a scam that works through a fake message, call or website that pretends to be someone you trust.
• Malware is harmful software. Phishing is often how it reaches you: a link or file in a message that installs it.

So a phishing message might lead to a scam (you pay for something that does not exist), to malware (an app that reads your messages), or simply to a stolen password.

The main types of phishing

• Email phishing. The classic version. Fake invoices, fake password resets, fake delivery notices.
• Smishing. Phishing by SMS or messaging apps. Very common in India: fake bank alerts, fake KYC updates, fake offers on WhatsApp. See smishing, vishing and quishing explained.
• Vishing. Phishing by phone call, where someone pretends to be your bank, the police or customs. The most frightening version is the digital arrest call.
• Quishing. Phishing through QR codes, which hide the real address from you.
• Spear phishing. A message written for one person, using real details about their job or life. It often pretends to be a boss or a supplier asking for a payment.
• Fake pages and adverts. A copy of a real login page, reached through a search advert or a link, built to capture what you type.

Why it works on smart people

People often think, “I would never fall for that.” But these messages are designed to land at the exact moment you are busy, tired or worried. A small phone screen hides most of a web address. A message that seems to come from a friend, or from a group you are in, lowers your guard. A deadline makes you act before you think.

Falling for one does not mean you were careless. It means the message did its job. That is why the best protection is a habit you follow every time, not a rule you have to remember under pressure.

A few examples of what it looks like

• “Dear customer, your account will be blocked today. Update your KYC now.” followed by a link. This is the KYC scam.
• “Your parcel is on hold at customs. Pay a small fee to release it.” This is the parcel fee trick.
• “Money is on its way. Approve the request to receive it.” This is the UPI collect request trick.
• “Easy part-time work. Earn daily by liking videos.” This is the WhatsApp task scam.

Each looks different. Each follows the same four steps.

Signs to look for

• You were not expecting the message.
• It creates urgency or fear: blocked, expired, arrested, last chance.
• It asks for an OTP, a PIN, a password or card details. A real company will not.
• The web address is slightly off, or it is a shortened link.
• It asks you to pay in an unusual way, or to install an app from a link.
• It asks you to keep it secret, or to stay on the phone.

A padlock in the browser does not mean a page is safe. It only means the connection is encrypted. Scam pages use it too.

What to do instead

1. Stop. Do not tap, reply or call the number in the message.
2. Go to the source yourself. Open the official app, or type the website address yourself.
3. Check the link before you open it. Paste it into the RIEG link checker. It looks at the link without opening it on your device. To learn to do it by eye, read how to read a link before you click it.
4. Never share an OTP or UPI PIN. Nobody genuine needs it from you.
5. Slow down. A real request can wait ten minutes while you check it.
6. If you slipped, act fast. Here is what to do in the first ten minutes, and how to report it.

Protecting the people around you

Older relatives and young people starting their first job are often targeted hardest. Two simple habits help everyone in a family or team:

• Agree that no genuine organisation will ever need an OTP or PIN, so anyone who asks is a scammer.
• Agree that it is always fine to say “let me check and call you back”, and that nobody will be angry if you do.

The short version

Phishing is a trick of trust and timing. You cannot stop people sending these messages, but you can stop them working: pause, go to the official source yourself, never share an OTP or PIN, and check a link before you open it.