Do Not Click Unknown Links: How to Spot Phishing Links and Stay Safe

A message pops up on your phone: your KYC is pending, your parcel is stuck, your electricity will be cut tonight, or you have won a cashback. Each one carries a link and a reason to tap it right now. Most of these messages are fake, and the link is the trap.

The good news is that a phishing link can only hurt you if you act on it. This guide explains how link scams work, the common types doing the rounds, a simple way to check any link, and the exact steps to take if you have already clicked.

What Is a Phishing Link?

A phishing link is a web address sent by a fraudster that pretends to come from a bank, government office, courier, utility or brand you trust. It leads to a fake website that steals your login details, card details or OTP, or it quietly installs a harmful app on your phone. When the trick arrives by SMS it is called smishing, and the same scam also travels through WhatsApp, email and social media.

How Does a Phishing Link Scam Work, Step by Step?

• The bait arrives. You receive an SMS, WhatsApp message, email or social media message that looks like it is from a bank, courier, electricity board, tax office or popular brand.
• Urgency is created. The message warns that your account will be blocked, your power cut, or a reward will expire within hours.
• You are pushed to click. A link is offered as the quick fix: "update KYC here", "pay pending bill", "claim reward", "reschedule delivery".
• A fake page opens. The page copies the look of a real website and asks for your customer ID, password, card number, CVV, UPI PIN or the OTP that just arrived on your phone.
• Or an app is installed. Some links download an APK file, a phone app from outside the official app store. Once installed, it can read your SMS, capture OTPs or let the fraudster control your screen.
• Money moves out. With your details or OTP, the fraudster logs in, adds a payee, makes a card payment or sends money through UPI, often within minutes.

What Are the Common Types of Phishing Links?

Fake KYC or PAN Update Links

The message claims your bank account, wallet or SIM will be blocked because your KYC or PAN details are not updated, and gives a link to "complete it now". Banks do not ask you to update KYC through a link sent by SMS or WhatsApp.

Fake Reward, Cashback and Credit Card Points Links

You are told you have won cashback, a lucky draw or that your credit card reward points are about to expire. The link asks for card details and an OTP to "redeem" them. The OTP actually approves a payment out of your account.

Fake Electricity Bill and Disconnection Links

A message says your electricity will be disconnected tonight because last month's bill was not updated. It shares a link or a mobile number to "pay now". This scam often leads to a screen-sharing or bill-payment app being installed.

Fake Parcel and Courier Links

A delivery could not be completed, an address is incomplete, or a small fee is due. The link leads to a fake courier page that collects card details.

Fake Bank Websites

These pages copy a bank's logo and login screen, but the web address is slightly off. You can read more in our guide on fake AU Small Finance Bank website fraud.

Malicious APK Links

A link asks you to download an "app" to complete KYC, pay a bill, track a parcel or claim a refund. These files come from outside the official app store and can take over your phone. See our do's and don'ts of suspicious apps and APK files.

What Are the Red Flags in a Suspicious Link or Message?

Watch for these warning signs before you tap anything.

• The message creates panic or a tight deadline, such as "today", "within two hours" or "last warning".
• It comes from a personal mobile number or an unknown WhatsApp account, not an official sender.
• It asks for your OTP, UPI PIN, CVV, password or full card number.
• The link uses a short link, a random string of letters, or a free website builder.
• The website address has spelling mistakes, extra words or an unusual ending.
• It asks you to download an app from a link, not from the official app store.
• It promises a reward you never applied for.

How Can You Tell a Genuine Message From a Fake One?

How Do You Check a Link Before Clicking It?

The safest habit is simple: do not click links in unexpected messages at all. If you are unsure, use these checks.

• Pause and ask why. Were you expecting this message? If not, treat it as suspicious.
• Read the full address. On a phone, press and hold the link to preview it without opening. On a computer, hover over it. Check every letter of the domain name, especially the part just before the ending.
• Look for the official bank domain. Banks in India are moving their websites to the exclusive ".bank.in" domain. AU Small Finance Bank's official website is au.bank.in. Anything else that claims to be the bank deserves a second look.
• Do not trust the padlock alone. A padlock only means the connection is encrypted. Fake sites can have one too.
• Go to the source yourself. Instead of clicking, open the official app or type the bank's address into your browser. If something truly needs your attention, you will see it there.
• Call the official number. Use the customer care number printed on your card or listed on the official website, never the one in the message.

What Should You Do If You Clicked a Phishing Link or Entered Your Details?

If you have clicked a link, do not panic, but act quickly. Speed gives you the best chance of stopping a loss.

If You Only Clicked and Did Not Enter Anything

• Close the page right away and do not enter any detail.
• Do not install anything the page asks you to download.
• Keep an eye on your bank SMS alerts for the next few days.

If You Entered Details, Shared an OTP or Installed an App

• Block your card and disable UPI immediately. Open the AU 0101 App to block your debit or credit card and turn off UPI, or call AU Small Finance Bank customer care on 1800 1200 1200.
• Change your passwords and PINs. Reset your net banking password, mobile banking MPIN and UPI PIN from a safe device. Change your email password too if you used it.
• Remove unknown apps. Uninstall any app you installed from the link, especially screen-sharing or remote-access apps. If your phone behaves oddly, switch to flight mode and get it checked.
• Report the fraud at 1930. Call the national cyber crime helpline 1930 as soon as possible, or file a complaint at cybercrime.gov.in. Quick reporting helps authorities try to hold the money before it moves further.
• Report the message on Sanchar Saathi. Use the Chakshu facility on the Sanchar Saathi portal to report the suspicious SMS, call or WhatsApp message, so the number can be acted on.
• Keep evidence. Save screenshots of the message, the link, transaction alerts and call logs. You may need them for your complaint.
• Check your statements. Review your account and card statements over the next few weeks for any unknown transactions.

For more on keeping one-time passwords safe, read our tips to keep your OTP safe from online fraud.

How Can You Keep Your Family and Senior Citizens Safe?

Parents, grandparents and first-time smartphone users are often targeted because they are newer to digital banking. A few family habits go a long way.

• Set one simple rule: "Never click a link from a bank, bill or courier message. Call me first."
• Save official numbers: Store the bank's customer care number and 1930 in their phone contacts.
• Turn on alerts: Make sure SMS and app alerts are switched on for every transaction.
• Lock app downloads: On Android phones, keep installs from unknown sources turned off, and show them how to block a card from the official bank app.
• Talk about it openly: Share real scam messages as examples, so they learn the pattern without feeling embarrassed.

Our guide to the different types of digital banking frauds is a useful read to share with family members.

How Does AU Small Finance Bank Keep You Safe?

Keep these points in mind whenever you receive a message in the bank's name.

• AU Small Finance Bank never asks for your OTP, PIN, CVV or password over a call, SMS, email or website link.
• AU Small Finance Bank never asks you to share your OTP, PIN, CVV or passwords through a link, call or message. Treat any "update KYC" link you receive with suspicion and check only through official channels.
• The official website of AU Small Finance Bank is au.bank.in. Always type it yourself.
• The AU 0101 App lets you block your card and manage UPI on your own, any time.

If a message in the bank's name does not match these points, do not respond. Report it and contact the bank through official channels.

Conclusion

Phishing links work because they arrive at a busy moment and ask for one quick tap. Not clicking links in unexpected messages, and going to the official app or website instead, shuts the door on most of these scams.

If you ever do click, speed matters more than anything else. Block your card and UPI, change your passwords, call 1930 and report the message. Share this with your family, because the strongest protection is a household where everyone knows the rule: when in doubt, do not click.

Frequently Asked Questions (FAQs)

Can my phone get hacked just by clicking a link?

Simply opening a link rarely takes over a phone on its own. The real danger comes when the page asks you to enter details, approve a request or install an app. However, some links can download harmful files in the background, so it is best not to open unknown links at all. If you clicked one by mistake, close the page, do not install anything, and keep your phone software updated.

What is smishing?

Smishing is phishing through SMS. Fraudsters send text messages that pretend to come from a bank, courier, utility company or government office. The message usually carries an urgent warning and a link to a fake website or a harmful app. The same trick is now common on WhatsApp and social media, so treat any unexpected message with a link carefully, whatever app it arrives on.

What should I do if I get a link asking me to update my KYC?

Do not click it. AU Small Finance Bank never asks you to share your OTP, PIN, CVV or passwords through a link, call or message. Check your KYC status only through the official AU 0101 App, the official website au.bank.in or your nearest branch, and report the suspicious message on the Chakshu facility of the Sanchar Saathi portal.

How do I report a phishing SMS or WhatsApp message?

You can report a suspicious SMS, call or WhatsApp message on the Chakshu facility of the Sanchar Saathi portal. It lets you share the sender's number, the message and a screenshot. If you have already lost money, call the cyber crime helpline 1930 or file a complaint at cybercrime.gov.in, and also inform your bank right away.

What should I do first if I shared my OTP or card details?

Act within minutes. First, block your card and turn off UPI through the AU 0101 App or by calling AU Small Finance Bank customer care on 1800 1200 1200. Next, call 1930 or file a complaint at cybercrime.gov.in. Then change your passwords and PINs, remove any app you installed, and save screenshots of the message and transactions as evidence.

Is a website safe if it shows a padlock and "https"?

Not always. The padlock and "https" only mean the connection between your device and the website is encrypted. Fraudsters can easily get this for fake sites too. What matters more is the exact website address. Check the full domain name letter by letter, and for banking, type the official address yourself rather than following a link.

Are links from known contacts on WhatsApp safe?

Not necessarily. Your friend's or relative's account may have been hacked, or they may have forwarded a scam message without knowing it. Be cautious with forwarded links about rewards, government schemes, jobs or free recharges. If a known contact sends an unusual link or asks for money, call them on their regular number to confirm before you act.

How can I identify a fake bank website?

Look closely at the web address. Fake sites often add extra words, swap letters, use hyphens or carry an unusual ending. Banks in India are moving to the exclusive ".bank.in" domain, and AU Small Finance Bank's official website is au.bank.in. Other warning signs include pop-ups asking for your OTP, poor design, spelling errors and requests for your full card details.