Phishing what it is and how it works: India guide

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

Phishing is the use of a fake message, email, call or website to make you hand over a password, a card detail or a payment. The fraud does not break your account; it persuades you to open it. This guide explains how a phishing attack actually runs, which sections of Indian law apply, and what to do the moment you realise you responded.

Phishing is deception delivered through a communication channel. A message claims to come from your bank, a courier, a government office, your employer or a service you use, and asks you to click a link, enter a password, confirm a card detail or make a payment. The attacker never breaks into your account; you open it for them. That is why the offence is charged as cheating and identity fraud rather than as hacking, and why the law looks closely at what the victim was induced to do.

The term covers several delivery methods. Email phishing is the oldest. Smishing arrives by SMS, vishing by voice call, and quishing by a QR code that leads to a fake payment page. Spear phishing is targeted at a named person, using details gathered about them, and is far more convincing than a bulk message. Clone phishing copies a genuine message the victim has received before, replacing the link. Each variant exploits the same weakness: trust in a familiar brand or a familiar person.

Phishing is also distinct from pharming, where malicious software redirects a correct web address to a fake page without any message being sent. That distinction matters because in pharming the victim did nothing wrong and only the device was compromised, while in phishing the complaint usually turns on what the victim was persuaded to do with their own credentials.

The anatomy of a phishing attack

A phishing campaign is not a single moment of trickery. It is a chain, and each link has a purpose. Understanding the chain helps you recognise where you are in it and which evidence still survives.

Preparation: the attacker gathers a list of targets, often from a data leak, and registers a domain or buys a lookalike address.
Lure: a message creates urgency, such as a blocked account, a failed delivery, a refund or a penalty.
Capture: the victim clicks through to a page that mimics the real service and enters credentials, an OTP or card details.
Exploitation: the credentials are used immediately, or the payment is collected through a mule account.
Consolidation: the funds are layered or converted, and the fake page is taken down or recycled.
Re-targeting: the victim's details are added to a fresh list and may be used again, sometimes in a second scam posing as a recovery service.

The infrastructure behind a phishing page

A convincing fake page is rarely built from scratch. Ready-made kits let an attacker clone a banking login, a payment screen or a courier tracking page within minutes, and cheap hosting allows several such pages to run from one server. The domain is chosen to survive a quick glance: a hyphen added, a letter changed, or a different country suffix. The money collected does not stay with the person who built the page. It passes into mule accounts or payment gateways opened with borrowed identity, which is why tracing recovery is a matter of hours, not months.

Understanding this layer matters practically. When you report, the fake domain and the beneficiary account are two separate pieces of infrastructure, and each can be acted upon independently. A takedown request targets the first; a freeze request targets the second.

Variants you will actually meet

Labels matter because they shape the evidence and the legal framing. The table below sets out the common forms and the tell that gives each away.

Type	Channel	Recognisable sign
Email phishing	Email with a link or attachment	Sender domain differs from the real one by a character
Smishing	SMS or messaging app	Short link, unfamiliar number, urgent demand
Vishing	Phone call	Caller knows partial data and pushes for an OTP or remote access
Quishing	QR code	A code that opens a payment request rather than a merchant page
Spear phishing	Email or message, targeted	Accurate personal detail, often about work or finances
Clone phishing	Copy of a genuine message	A familiar thread with an altered link or account number

What the law says

Where phishing leads to cheating by impersonation through a computer resource, section 66D of the Information Technology Act 2000 applies. Where a password or other unique identification feature is used dishonestly, section 66C applies, and section 66 covers the broader computer-related offences. Where the fake page or message carries obscene or morphed material, sections 67 and 67B of the Act come into play.

On the criminal side, the core charge is cheating under section 318(4) of the Bharatiya Nyaya Sanhita 2023, with section 316 BNS available where money was entrusted and later misappropriated and section 336 BNS where forged documents or a false identity were used to receive funds. A cognizable offence is registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, and section 35 permits a zero FIR at any station. If the police decline to register, section 175(3) BNSS allows an application to the magistrate. Electronic records, including the email headers, the chat and the transaction logs, are proved under section 63 of the Bharatiya Sakshya Adhiniyam 2023 with the prescribed certificate. RBI's directions on unauthorised electronic transactions govern the bank's response once a debit is reported.

Why competent people fall for phishing

The campaign is designed around attention rather than intelligence. It arrives when you are between tasks, it mimics a service you genuinely use, and it imposes a deadline. A courier message when you are expecting a parcel, a bank alert on a day you are anxious about a payment, or an employment offer when you are job hunting will all read as plausible. The attacker's skill is not in the technology but in matching the lure to the moment.

Urgency: a penalty, a block or a deadline that discourages checking.
Authority: a logo, a department name or a caller who sounds official.
Familiarity: a brand, a colleague or a message thread you already trust.
Smallness of the ask: an OTP or a card detail feels like a minor step, not a transaction.

Phishing aimed at businesses

A workplace is a richer target than one consumer account. The invoice fraud variant sends an amended bank account number on a genuine-looking purchase order, and the payment is made before anyone notices. The chief executive variant asks a junior employee, apparently from a senior, to make an urgent transfer. The compromised mailbox variant uses access to a real email account to send payment instructions from it, which defeats most instinctive checks.

Businesses face an added consequence: the loss falls on the company, and internal approvals complicate the argument that the payment was unauthorised in the RBI sense. Prompt reporting and a documented verification protocol for account changes are the practical safeguards, and a mismatch between internal procedure and the actual transfer tends to feature heavily in any later dispute.

The red flags, in plain terms

Most phishing has at least one visible flaw. The link address does not match the brand. The sender address ends in a public mail service. The language mixes a formal tone with errors and odd spacing. The page asks for an OTP, a CVC or a password on a screen that looks like a login but arrived from a message. Genuine institutions do not ask you to enter a full OTP or card detail on a link they send, and they do not demand payment by gift card, crypto or a transfer to a personal account.

A domain that differs from the official one by a letter, a hyphen or a suffix.
Pressure to act in minutes, or a threat of legal action or account closure.
A request for an OTP, a PIN or a card verification value.
A payment route that is not the institution's official channel.
A reply-to address that is a free mail service rather than the organisation.

What to do the moment you realise you responded

Speed decides whether the money is recoverable. If you entered banking credentials, change the password and revoke active sessions immediately, then tell the bank. If you shared a card detail, block the card. If money already left, report to 1930 and on cybercrime.gov.in, and ask the bank to freeze the beneficiary account. Preserve the original message in full, including the headers, and do not delete it. Then file a police complaint and keep the receipt.

Even a message you did not act on is worth preserving and reporting, because the same campaign will reach others, and the portal aggregates such reports to identify the infrastructure behind them. Warnings posted in a group chat or an office channel are useful too, though they are not a substitute for reporting to the authorities.

What decides whether money is recoverable

Recovery turns on where the funds still are and how quickly you reported. A payment recalled within hours, before layering, can sometimes be reversed. A payment routed through several mule accounts and converted to crypto is far harder to recover, though the trail remains evidence. The strength of your report also matters: a full copy of the original message, the exact link and the transaction reference give investigators something to work with, while a vague complaint does not.

Common misconceptions

Phishing is often confused with hacking, but the two are different and the distinction affects the case. It is also wrongly assumed that a bank is always liable when a customer is tricked, or always immune when an OTP was used. Neither is true. The law and RBI's directions weigh how the disclosure occurred, whether reasonable care was taken, and how promptly the fraud was reported.

A third misconception is that a small loss is not worth reporting. A report does two things beyond your own claim: it triggers a freeze request that may catch the account before other victims pay into it, and it feeds the data that investigators use to trace networks. Reporting a small loss is not wasted effort.

Reducing the risk after you have reported

Once a phishing message has reached you, the same details often surface again in a second attempt. Attackers resell lists, so expect further contact that references the first one: a recovery offer, a refund request or an official-sounding follow-up. Treat any message that asks for a fee to return your money as a fresh fraud, because it is one. Change the passwords you used at the time and anywhere you reused them, and check your account recovery settings to confirm that your number and email are still under your control.

Report the message itself, not only your loss. A takedown request against the fake domain reduces the campaign's reach, and flagging the beneficiary account helps mark it before other victims pay into it. Preservation matters even now: keep the original message, the link and the transaction reference until the matter is closed, because a case can be reopened or appealed long after the first complaint was filed.

When to involve a lawyer

Most phishing complaints are handled through the bank and the cyber crime portal without a lawyer. One becomes useful when the bank rejects liability, when the police refuse to register, or when the amount and the traced accounts justify pressing the matter through the magistrate. A cyber crime lawyer in Kolkata can prepare the evidence index and the section 175(3) BNSS application. The firm's cyber crime practice page explains the sequence, and the blog carries short guides on individual fraud types. Early advice costs less than a mis-stated complaint.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What exactly is phishing in simple terms?

Phishing is a fake message, email, call or website that tricks you into handing over a password, an OTP, card details or money. The attacker does not break into your account; the fake communication persuades you to open it or pay. It is charged in India as cheating and identity fraud, not as unauthorised access.

Which law covers phishing in India?

Sections 66C and 66D of the IT Act 2000 cover dishonest use of credentials and cheating by personation through a computer resource, and section 66 covers computer-related offences generally. The underlying charge is cheating under section 318(4) BNS, with section 336 BNS applying where a false identity or forged document was used.

Is phishing the same as hacking?

No, they are legally different. Hacking is unauthorised access to a system, while phishing is induced disclosure by the account holder. The distinction matters because the evidence and the defence differ: in phishing the prosecution must show the deception and the inducement, while in hacking it focuses on access without permission and on the security of the system.

I entered my bank details on a phishing link. What should I do first?

Change your banking password and revoke active sessions immediately, then inform your bank and block any affected card. If money has already left, call 1930 and file on cybercrime.gov.in and ask the bank to freeze the beneficiary account. Preserve the original message in full, including the sender address and any link, before deleting anything.

Can I get my money back after a phishing payment?

Often only partly, and it depends on speed and tracing. A transfer reported within hours, before the funds are layered, can sometimes be reversed or frozen. Once the money is routed through mule accounts or converted to crypto, recovery becomes much harder, though the trail still supports a criminal case.

What are the clearest signs that a message is phishing?

A domain that differs from the official one by a letter or suffix, urgent pressure to act within minutes, and a request for an OTP, PIN or card verification value are the clearest signs. Genuine institutions do not ask for a full OTP or card detail through a link they send, nor demand payment to a personal account.

Does the police register a case if the phishing site is hosted abroad?

Yes. Jurisdiction is not limited by where the server sits. An FIR can be registered under section 173 BNSS, or a zero FIR under section 35 at any station, and the investigating officer can seek assistance for the foreign-hosted infrastructure through the appropriate channels while pursuing the domestic beneficiary accounts.

Should I report a phishing message even if I did not lose money?

Yes, and it is genuinely worth doing. Reporting a message you avoided helps the portal map the campaign and may trigger takedown of the fake domain or flag the beneficiary accounts before other victims pay into them. Preserve the full message, including the headers, and submit it through cybercrime.gov.in without altering it.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact