The message arrives with a deadline. "Your account will be blocked in 24 hours. Verify immediately." Sometimes it is a police call. Sometimes a job offer. The words change. The play does not.
Five things give it away. It creates urgency. It threatens account closure. It sends a suspicious link. It asks for sensitive details like your bank account number, date of birth or PAN. And it tells you not to bother with the bank's official channel. One of these is a warning sign. Two is almost certainly fraud. All five together means someone is working you.
The message
It creates urgency, threatens your account and sends a link. Real banks never close your account by WhatsApp message. You can stop the whole fraud right here.
Don't click.
The fake page
One click usually does no harm. The damage starts when you type details into a page like this. Look at the web address. If it is not your bank's real address, close the tab.
Give nothing.
The app
Now they need an app on your phone, because the app can read your SMS and catch the one time passwords your bank sends. Nothing good is inside that download.
Don't download.
The permissions
If it reached your phone, do not install it. If it is already installed, deny every permission and remove it. SMS and contacts are exactly what it is after.
No permissions.
The money is gone
This is what the whole play was for. Act fast: call your bank, report on 1930, the national cyber fraud helpline, and change your passwords from another device.
Act fast.
Here is the part most people get wrong. Clicking a link does not hack your phone. The harm starts when you hand something over: your account number, your date of birth, your PAN, or a one time password. Or when you download their app and install it, because that app is built to read your messages and catch the OTPs your bank sends.
You can stop at any step. Don't click. If you clicked, look at the web address and give nothing. Don't download their app. If it downloaded, don't install it. If it is installed, grant no permissions and remove it. Every step you skip, the fraud dies.
If money has already left: call your bank right now, then report it on 1930, the national cyber fraud helpline. If you installed their app: uninstall it, revoke permissions, and change your passwords from another device. And about that police call: real police do not ask for money, OTPs or bank details over the phone. Call the official number yourself if you are unsure.
This is not rare. Government figures record more than 5.38 million cyber fraud complaints over the last three financial years, with over ₹56,087 crore reported. The person behind the message is not a genius. Their entire plan depends on you handing them the keys.
If a message has made you unsure, stop and verify through the bank's official number. And if you run a business, remember that your customers face these messages every day.