Scam SMS: 6 warning signs to check before you tap
Fake KYC alerts, electricity disconnection threats, prize messages. Six signs that give away a scam SMS, and what to do when you get one.
Scam messages used to be easy to spot. Now they copy the tone of your bank, use your name and arrive between real OTPs and delivery updates. The good news is that almost every scam SMS still gives itself away with at least one of these six signs.
1. It asks for your OTP or PIN
This is the big one. Real banks never ask for your OTP. An OTP is how you approve a payment or a login. Anyone who asks you to share it, by SMS, call or WhatsApp, is asking you to approve something for them.
2. The link looks almost right
Scammers register addresses that look like the real thing at a glance: an extra letter, a swapped character, the bank’s name followed by unrelated words. Read the address slowly, all the way to the end. If you’re not sure, don’t tap. Open the official app or type the address you already know.
3. The link is shortened
A shortened link hides where it goes. Banks and government services usually link to their own domain. A short link in a message about your account, your KYC or a payment should make you stop.
4. It’s urgent, and it threatens you
“Your account will be blocked today.” “Electricity will be disconnected at 9:30 pm.” “KYC expired, update now.” Pressure is the point: it’s meant to get you acting before you think. Real organisations give you time and a way to check through official channels.
5. You’ve won something you never entered
Lottery wins, cashback you didn’t earn, a gift from a brand you’ve never shopped with. If you didn’t enter, you didn’t win.
6. The sender doesn’t match the story
A “bank” message from a regular 10-digit mobile number, or a “courier” message for a parcel you never ordered. Real service messages usually come from a business sender ID, not a personal number. A matching sender ID doesn’t prove a message is real, but a mismatch is a strong warning.
What to do when you get one
- Don’t tap, don’t reply, don’t call back a number from the message.
- Check through the official app or website of the bank or service.
- Report it. In India you can report suspected fraud communication on the government’s Sanchar Saathi portal, and financial cyber fraud on the national helpline 1930 or cybercrime.gov.in.
- If you already shared an OTP or paid, call your bank right away using the number on your card or its official app.
Let your SMS app check for you
Reading every message this carefully is tiring, which is why I built scam warnings into Inboxwise. It flags look-alike links, shortened links, requests for your OTP or PIN, urgent threats and prize scams, and tells you exactly why a message looks suspicious. It does this on your phone: Inboxwise has no internet permission, so your messages never leave your device.