Phishing and social engineering.
More than 9 out of 10 successful cyber attacks start with a message that tricks a human. Not a genius hacker, just a clever lie. Today you'll learn every trick they use, so they never work on you or your family.
What is phishing?
Phishing is when an attacker pretends to be someone you trust (a bank, a delivery company, your boss, a friend) to make you click a link, open a file, share an OTP or send money. The name comes from "fishing": throw bait, wait for someone to bite.
| Type | Comes through | Hyderabad example |
|---|---|---|
| Phishing | "Your Netflix payment failed, update card here" | |
| Smishing | SMS | "Your parcel is held at the post office, pay ₹25 here" |
| Vishing | Phone call | "Sir, I'm calling from the bank, tell me the OTP to stop the fraud" |
| Spear phishing | A message made for one person | An email to an accountant that looks exactly like it's from the CEO |
The 6 tricks on your mind
Social engineering works because it uses normal human feelings against you. Learn these six and you'll recognise almost every scam.
A very common scam in India: a video call from someone in a fake police uniform says you are under "digital arrest" and must stay on the call and transfer money to "clear your name". There is no such thing as digital arrest in Indian law. Real police never ask for money on a video call. Cut the call and report it on 1930.
How to check a link like a pro
Attackers make links that look right at a glance. Train your eye to read the real domain: the part just before the first single /, read from right to left.
| Link | Real domain | Safe? |
|---|---|---|
| https://www.onlinesbi.sbi/ | onlinesbi.sbi | Yes, official SBI |
| https://onlinesbi.sbi.kyc-update.in/login | kyc-update.in | No. "onlinesbi.sbi" is just a decoration in front |
| https://amaz0n-offers.shop/sale | amaz0n-offers.shop | No. Zero instead of "o" |
| https://www.instagram.com.verify-badge.net | verify-badge.net | No |
On a phone, press and hold a link (don't tap) to see the full address first. When in doubt, don't click the link at all: open the official app or type the website yourself.
Which of these links really belongs to HDFC Bank?
Read from right to left before the first "/": only the second one is hdfcbank.com. The first is really secure-login.co.
Game: phishing or not?
Phishing. Urgency, a shortened link, and a look-alike domain. Track parcels only in the official app or website with your real tracking number.
Fine. Normal request, normal channel, nothing secret, no unusual payment.
Classic CEO fraud. New number, authority, urgency, gift cards. Always verify by calling the person on their known number.
Vishing. No bank ever asks for an OTP. The OTP is exactly what lets them take the money.
What to do if you clicked
Everyone can be fooled once. What matters is acting fast:
- Disconnect the internet on that device if you downloaded something.
- Change the password of the affected account from a different, safe device, and turn on 2FA.
- If money or bank details are involved, call your bank immediately to block the card or account.
- Call 1930 (National Cyber Crime Helpline) or report on cybercrime.gov.in. Speed matters: money can sometimes be frozen if reported within hours.
- At a company, tell the IT/security team immediately. A good company will thank you, not blame you.
An employee clicked a phishing link and typed their password, then realised. What should they do FIRST?
Speed beats shame. Changing the password and reporting quickly lets the team block the attacker before they use the stolen login.
Your task (15 min)
Sit with your parents or grandparents for 15 minutes. Show them three scam messages from this lesson and teach them the rule: no bank, police or company ever asks for OTP, PIN or money on a call. Save 1930 in their phone as "Cyber Crime Helpline". This might be the most valuable security work you ever do.
Lesson 6 complete!
You can now recognise phishing, smishing and vishing, the 6 psychological tricks attackers use, and how to check links properly. Next: what malware and ransomware actually do.
Next: Malware and ransomware →