How to spot a fake link before you tap it

Phishing is a message that tricks you into opening a fake page or sharing a secret. The page may look identical to your bank's. The address is where the truth lives.

Four five-second checks

1. Read the domain, right to left from the first single slash. In hdfc.secure-login.example.com, the real domain is example.com, not hdfc.
2. Look for small spelling tricks: paytrn, rnicrosoft (r+n looks like m), a zero instead of an O.
3. Distrust shortened links and links in messages that create urgency: "today", "blocked", "last warning".
4. Ask what the page wants. Banks never need your OTP, PIN or CVV just to "verify" you.

A safer habit

Do not use links in SMS or chats for banking at all. Open the official app, or type the bank's address yourself. Save official numbers in your phone from the back of your card.

A padlock icon only means the connection is encrypted. Scam sites have padlocks too.

If you already tapped

Do not enter anything. Close the tab. If you did enter details, call your bank at once and, if money moved, call 1930.