Phishing & Fake Messages

Question 1

A banking email links to 'mybank-secure-login.example' instead of the bank's normal domain. The page looks professional. What is the strongest warning sign?

The visual appearance of a page is easier to copy than its legitimate web address.

The page contains a login form The page loads quickly The page uses modern graphics The web address is different from the bank's known official domain

Question 2

An SMS claims your credit card limit has been increased and asks you to confirm the upgrade through a link. You never requested an increase. What should you do?

Unexpected beneficial offers can be phishing bait too.

Accept immediately because a higher limit is beneficial Click the link but do not accept the final confirmation Reply with the last four digits of your card Verify the offer through your card issuer's official app or customer-care channel

Question 3

A fake banking website asks you to enter your username, password, card number, CVV, ATM PIN, and OTP on a single page. What should this combination tell you?

Consider whether a legitimate login should require every financial secret at once.

Enter everything except the OTP Enter the information if the page displays a padlock icon The request is highly suspicious and you should not submit the information The site is extra secure because it verifies many details

Question 4

An email says your bank statement is attached as 'Statement_August.exe'. You were not expecting the email. What is the safest action?

Pay attention to both the unexpected attachment and its file type.

Do not open it and obtain your statement through the bank's official app or website Forward it to a friend to see whether they can open it Open it because bank statements are normally sent by email Rename the file before opening it

Question 5

A message from an unknown number says, 'I accidentally sent ₹8,000 to your account. Please send it back.' Your bank account shows no such credit. What should you do?

Your actual account history matters more than the sender's claim.

Do not transfer money based on the message and rely on verified account records or your bank for resolution Send ₹1 first to confirm the UPI ID Send ₹8,000 because keeping accidental money is wrong Send your bank statement to prove you did not receive it

Question 6

A customer-care account on social media replies to your public complaint and asks you to continue in a private message by sharing your card number, CVV, and OTP. What should you do?

Fraudsters can watch public complaints and impersonate support teams.

Ask the account to send its logo before sharing the details Do not share the credentials and contact the organization using its independently verified support channel Share only the card number and CVV Share the information because the account contacted you about your real complaint

Question 7

You receive an email with no obvious spelling mistakes, correct branding, professional formatting, and a convincing explanation. Does that make it safe to follow its banking link?

Modern phishing does not have to look poorly written.

No. The request, sender, destination, and context still need to be evaluated or independently verified Yes, correct branding proves the organization sent it Yes, if the email is longer than one paragraph Yes, phishing emails normally contain obvious mistakes

Question 8

An email claiming to be from your bank begins with 'Dear Customer' and asks you to confirm your account details through a link. Is the generic greeting alone proof that the email is fraudulent?

Distinguish a warning sign from conclusive proof.

No, but the unexpected request and link should still be independently verified No, so the email and its link can automatically be trusted Yes, but clicking the link is safe as long as you do not enter a password Yes, every genuine bank email always uses your full name

Question 9

A message claims your FASTag has been blocked and asks you to update your bank details through a link. You have not noticed any FASTag problem. What should you do?

Verify the claimed problem before interacting with the message.

Enter your details because FASTag is linked to banking services Forward the message to other drivers Reply with your vehicle number first Verify your FASTag status using the official issuer app or website without using the supplied link

Question 10

You receive an email saying your bank account has been locked. Instead of a link, it provides a QR code that supposedly unlocks the account. How should you treat the QR code?

QR codes can hide destinations just as shortened links can.

As automatically safe because it is not a clickable link As safe if the email contains your name As safe if your phone's camera recognizes it As suspicious until the account issue is independently verified through the bank

Question 11

A message claiming to be from your bank asks you to call a mobile number immediately to reverse a suspicious transaction. What is the safest way to contact the bank?

Do not let a suspicious message choose the channel you use to verify it.

Call the number in the message because it is specifically for fraud cases Reply asking the sender whether the number is genuine Search social media comments for someone claiming to represent the bank Use a customer-care number obtained independently from the bank's official app, website, or other trusted bank source

Question 12

An email claims to be from your bank's fraud department and correctly describes a transaction you recently made. It then asks for your internet banking password to 'confirm ownership.' What should you do?

Correct contextual information does not make a request for a password appropriate.

Change the password to something temporary and send that instead Do not provide the password and independently contact the bank if verification is needed Provide only part of the password Provide the password because the sender knows about a real transaction

Question 13

You receive an SMS claiming your mobile number will be disconnected unless you complete bank-linked identity verification through a supplied URL. What should you do?

Unexpected service-disconnection threats are designed to create urgency.

Click the link but leave if the website looks suspicious Send your identity documents directly by replying to the SMS Use the supplied URL before your number is disconnected Verify the claim independently through your mobile provider's official app, website, or support channel

Question 14

You receive an unexpected 'bank security alert' from the same SMS conversation where genuine bank messages have appeared before. Should you automatically trust it?

Where a message appears is useful context, but it should not override suspicious content.

No. Evaluate the request itself and independently verify suspicious actions or links Trust it if it arrived during banking hours Yes, as long as previous messages in the thread were genuine Yes, messages appearing in an existing bank thread are always genuine

Question 15

A relative messages you from a new phone number saying their phone was damaged and they urgently need money. What is the safest first step?

The story may be plausible, but the new number has not been authenticated.

Ask the new number whether they really are your relative Send a smaller amount first Transfer the money because emergencies require quick action Verify the person's identity through another trusted contact method before sending money