Indian banks like SBI, HDFC, ICICI, and Axis are routinely impersonated in SMS phishing ("smishing") attacks. Here's how to identify and avoid them.
How Phishing SMS Works
Scammers send bulk messages that look like official bank communications. These messages typically create urgency — "Your account will be blocked" or "KYC update required immediately" — and include a malicious link.
Red Flags to Watch For
1. Sender ID Mismatch
Genuine bank messages come from a registered sender ID (e.g., "SBI", "HDFCBK"). Phishing SMS often comes from random mobile numbers or slightly misspelled sender IDs.
2. Urgency and Threats
"Act within 24 hours or your account will be frozen." Banks do not threaten account closure by SMS. This is a classic fear tactic.
3. Suspicious Links
Legitimate bank links use their official domain (e.g., sbi.co.in, hdfcbank.com). Phishing links use lookalike domains like "sbi-update.in" or "hdfc-kyc.com".
4. Requests for OTP or PIN
No bank will ask for your OTP, PIN, CVV, or password by SMS. If a message asks for any of them, treat it as a scam and stop there.
5. Grammar and Spelling Errors
Official bank communications are professionally written. Poor grammar and spelling mistakes are a giveaway.
What to Do If You Receive a Phishing SMS
1. Do NOT click any links in the message
2. Do NOT reply with any personal information
3. Report the number to your bank through the app or branch
4. Forward the SMS to 1909, the TRAI complaint number for unsolicited commercial messages
5. Report the fraud at cybercrime.gov.in, or call 1930, if you have already lost money or given away a credential
The Cyber Rakshak SMS Scanner
Coming at launch: paste or forward a message and the scanner scores it against the patterns in this article — UPI and KYC wording, links, and manufactured urgency — then tells you which of them it matched.
It is rule-based, not AI. The rules are a list of patterns with weights attached; there is no model and no training data, which is also why the scanner can be wrong, and why it shows you its reasons instead of a verdict you have to take on faith.
It does not read your inbox. The app does not request SMS permission at all — the only messages it sees are the ones you choose to give it. That is a deliberate trade: slightly more work for you, and no standing access to your messages for us.
The mobile app has not been released yet.
Don't let a fake SMS take your savings. When a message worries you, open your bank's own app and check there — never through the link you were sent.