Phishing Links: How to Spot Fake Websites and Messages
Understand phishing links that steal passwords, and quick checks to spot a fake site.
What a phishing link is
A phishing link takes you to a fake page that looks like your bank, Instagram, a government scheme or a delivery company. When you type your password, card details or OTP, the scammer receives them. Some links instead download a malicious app (.apk). Links arrive by SMS, WhatsApp, email, Instagram DMs, QR codes and even Google ads.
Check the address, not the logo
| Link | Real or fake? |
|---|---|
| https://www.onlinesbi.sbi | Real SBI domain (ends in .sbi) |
| https://onlinesbi.sbi.kyc-update.top | Fake – the real domain is kyc-update.top; read from the right of the first “/” |
| https://incometax.gov.in | Real (government sites end with .gov.in or .nic.in) |
| https://incometax-refund.in | Fake look-alike |
| https://amaz0n-offers.shop | Fake – zero instead of “o” |
| bit.ly/xyz, tinyurl… | Unknown – short links hide the destination |
Red flags in the message
- Urgency: “account blocked in 2 hours”, “last day for refund”.
- Rewards you did not apply for: lottery, free recharge, PM scheme money, job offer.
- Unknown sender or a personal mobile number pretending to be a company.
- Requests for password, OTP, PIN, CVV, or to install an app.
- Spelling mistakes, odd Hindi/English mix, wrong logos.
- Wedding invitations or “photos” sent as .apk files on WhatsApp.
Safe habits
- Do not tap links in unexpected messages. Open the official app or type the website address yourself.
- Long-press a link (phone) or hover (computer) to preview the real address.
- Install apps only from Play Store/App Store; keep “Install unknown apps” OFF for WhatsApp, Chrome and file managers.
- Turn on Chrome Enhanced Safe Browsing (Settings → Privacy and security → Security).
- Use a password manager – it will not auto-fill your password on a fake domain, a useful warning sign.
- Learn email-specific signs: identifying phishing emails.
If you clicked or entered details
- Entered a password: change it at once from the official site and log out other sessions; turn on 2-step verification.
- Entered card/bank details or OTP: block the card/UPI via the bank and call 1930.
- Installed an app: switch on airplane mode, uninstall it (Settings → Apps), remove it from Device admin apps if listed, and run Play Protect.
- Report the link: cybercrime.gov.in, and forward spam SMS to the telecom’s spam number or report on Sanchar Saathi → Chakshu.
Phishing link क्या होता है
Phishing link आपको ऐसे नकली page पर ले जाता है जो आपके bank, Instagram, सरकारी योजना या delivery company जैसा दिखता है। जब आप password, card details या OTP डालते हैं, scammer को मिल जाते हैं। कुछ links ख़तरनाक app (.apk) download करते हैं। Links SMS, WhatsApp, email, Instagram DMs, QR codes और Google ads से भी आते हैं।
Logo नहीं, address जाँचें
| Link | असली या नकली? |
|---|---|
| https://www.onlinesbi.sbi | असली SBI domain (.sbi पर ख़त्म) |
| https://onlinesbi.sbi.kyc-update.top | नकली – असली domain kyc-update.top है; पहले “/” से पहले दाएँ से पढ़ें |
| https://incometax.gov.in | असली (सरकारी sites .gov.in या .nic.in पर ख़त्म) |
| https://incometax-refund.in | नकली हमशक्ल |
| https://amaz0n-offers.shop | नकली – “o” की जगह zero |
| bit.ly/xyz, tinyurl… | अज्ञात – short links असली मंज़िल छिपाते हैं |
Message में ख़तरे के संकेत
- जल्दबाज़ी: “2 घंटे में account block”, “refund का आख़िरी दिन”।
- बिना apply किए इनाम: lottery, free recharge, PM योजना का पैसा, job offer।
- अनजान sender या company बनकर निजी mobile number।
- Password, OTP, PIN, CVV माँगना, या app install करवाना।
- Spelling की ग़लतियाँ, अजीब Hindi/English मिश्रण, ग़लत logos।
- WhatsApp पर .apk files के रूप में शादी के निमंत्रण या “photos”।
सुरक्षित आदतें
- अनपेक्षित messages के links पर tap न करें। Official app खोलें या website address ख़ुद type करें।
- असली address देखने के लिए link देर तक दबाएँ (phone) या hover करें (computer)।
- Apps सिर्फ़ Play Store/App Store से; WhatsApp, Chrome और file managers के लिए “Install unknown apps” OFF रखें।
- Chrome में Enhanced Safe Browsing चालू करें (Settings → Privacy and security → Security)।
- Password manager इस्तेमाल करें – यह नकली domain पर password auto-fill नहीं करेगा, जो एक उपयोगी चेतावनी है।
- Email के ख़ास संकेत सीखें: phishing emails पहचानना।
अगर click कर दिया या details डाल दीं
- Password डाला: तुरंत official site से बदलें और दूसरे sessions से log out करें; 2-step verification चालू करें।
- Card/bank details या OTP डाला: bank से card/UPI block करें और 1930 पर call करें।
- App install हुआ: airplane mode चालू करें, उसे uninstall करें (Settings → Apps), Device admin apps में हो तो वहाँ से हटाएँ, और Play Protect चलाएँ।
- Link report करें: cybercrime.gov.in, और spam SMS telecom के spam number पर भेजें या Sanchar Saathi → Chakshu पर report करें।
Frequently Asked Questions
Does https mean a website is safe?
No. Https only encrypts the connection. Phishing sites also use https, so always check the domain name.
How do I check a link before opening it?
Long-press or hover to see the full address and read the main domain just before the first “/”. If unsure, open the official app instead.
I opened a phishing link but entered nothing. Am I safe?
Usually yes. Close the page, do not download anything, clear the tab, and keep your phone and browser updated.
