Home / Guides

How to spot phishing emails, SMS and WhatsApp messages

By the FreeAllTool team · Updated October 28, 2026

Phishing is when criminals pretend to be a bank, delivery company, government office or even a friend to trick you into sharing passwords, card details or one-time codes. The messages can arrive by email, SMS, WhatsApp or phone call, and they are often convincing. Knowing the warning signs is the best defence.

Warning signs

  • Urgency or fear. “Your account will be blocked today”, “Your electricity will be cut tonight” or “Your parcel will be returned” are designed to make you act before thinking.
  • Requests for secrets. Real banks and companies never ask for your password, full card number, CVV, UPI PIN or OTP through a message or call.
  • Strange links. The link text may say one thing while the real address is different. Look for misspelled brand names, extra words or unusual endings, for example a bank name followed by random letters and a .xyz address.
  • Unexpected prizes or refunds. Messages claiming you won a lottery you never entered, or that a refund is waiting if you click, are classic scams.
  • Unknown attachments. Files such as .apk on Android, or documents asking you to “enable content”, can install harmful software.
  • Odd sender details. An official-sounding name with a personal email address or an ordinary mobile number is a red flag.

Messages that seem to come from friends

Scammers sometimes take over or copy a friend’s account and ask for urgent money or a code that was “sent to you by mistake”. Always confirm by calling the person on a number you already know.

What to do

  1. Do not click links or download attachments in suspicious messages.
  2. Go to the company’s official app or type its website address yourself to check your account.
  3. Report the message to the platform, and block the sender.
  4. If you entered a password, change it immediately and turn on two-step verification.
  5. If money was lost in India, call the national cyber crime helpline 1930 as soon as possible and file a complaint at cybercrime.gov.in. Also contact your bank right away.

Using a unique password for every site, created with a tool like our password generator, limits the damage if you are ever tricked once.

Related guides