Q.You got the below shown SMS from your bank querying a recent transaction. Answer the following: [SMS shown in the textbook, on a phone screen:] “Bank has noticed that your ATM card was recently used at XYZ online store on 26 November, 2018 at 1.00 p.m. for Rs.20010. If the transaction was not carried by you, urgently sms your pin number on 03036665458.”

Phishing Awareness

Imagine you receive an email that looks exactly like it came from your bank. The logo is correct, the language sounds official, and it warns you that your account will be closed unless you "verify" your details immediately. There is a button that says Click Here to Secure Your Account.

Most people's first instinct is to panic and click. That is exactly what the attacker is counting on.

What Phishing Actually Is

Phishing is a form of online fraud where a criminal impersonates a trusted person or organisation — a bank, a government agency, a delivery company, even a friend — to trick you into revealing sensitive information. That information might be your password, your credit card number, your Aadhaar number, or access to your online accounts.

The word itself is a play on "fishing": the attacker casts a bait (the fake message) and waits for someone to bite.

Why It Works So Well

Phishing exploits human psychology, not technical vulnerabilities. The attacker creates urgency ("Your account will be locked in 24 hours"), fear ("Unauthorised login detected"), or greed ("You have won a prize"). Under that pressure, most people stop thinking critically and act on impulse.

A well-crafted phishing message can look indistinguishable from the real thing. Attackers copy logos, email formats, and even the tone of voice used by the organisation they are impersonating.

Common Forms of Phishing

• Email phishing — the classic fake email with a malicious link or attachment.
• SMS phishing (smishing) — a text message that appears to come from your bank or a delivery service.
• Voice phishing (vishing) — a phone call where someone pretends to be from your bank or tech support and asks for personal details.
• Social media phishing — fake messages or profiles on platforms like Instagram or WhatsApp that ask for login credentials or payment.

How to Recognise a Phishing Attempt

There are reliable warning signs, even in a very convincing message:

• Generic greetings — "Dear Customer" instead of your actual name.
• Urgency or threats — "Act now or your account will be suspended."
• Suspicious links — hover your mouse over a link without clicking. If the web address looks strange (e.g., bankofindia-secure-login.xyz instead of bankofindia.co.in), it is a trap.
• Requests for sensitive information — no legitimate organisation will ask for your password, OTP, or PIN via email or text.
• Poor grammar or spelling — though this is becoming less common as attackers improve their messages.
• Unexpected attachments — especially files ending in .exe, .zip, or .docm. …