Common Attacks · Lesson 3 of 6
Phishing and Social Engineering: How Scams Work and How to Spot Them
The easiest system to hack is a person in a hurry. Learn the psychology attackers use, the common scams in India — fake KYC, UPI "refunds", fake job offers, digital arrest calls — the warning signs, and what to do if you have been targeted.
Firewalls, encryption and secure code mean nothing if someone can simply be persuaded to hand over the keys. Social engineering is manipulating people into giving away information, money or access. Phishing — fake messages that look like they come from someone you trust — is its most common form, and the starting point of a large share of cyber attacks on both individuals and companies.
The psychology: why smart people fall for it
Scams do not target stupidity; they target emotions that switch off careful thinking:
- Urgency — "Your account will be blocked in 2 hours."
- Fear — "A case has been filed against you. Stay on the call."
- Authority — "This is the bank / police / your college director."
- Greed or opportunity — "You have been selected for a ₹45,000/month work-from-home job."
- Helpfulness and trust — "Hi, it's your manager, I'm in a meeting, can you buy some gift cards?"
The one habit that beats almost every scam: when a message creates urgency or fear, stop and verify through a separate channel you trust — call the official number from the bank's website or the back of your card, not the number in the message.
Common scams in India
| Scam | How it works | The tell |
|---|---|---|
| Fake KYC / account block | SMS with a link: "Update PAN/KYC or your account will be suspended" | Banks do not send KYC links by SMS; the link domain is not the bank's |
| UPI "refund" or "receive money" | Someone sends a collect request or QR code and says "enter your PIN to receive the refund" | You never need your UPI PIN to receive money — only to pay |
| Fake job / task scam | WhatsApp/Telegram offer: like videos or rate hotels for money, then "invest" to unlock earnings | Real employers do not ask you to pay; easy money for simple tasks |
| "Digital arrest" | Callers pretending to be police or customs on a video call say you are under investigation and must transfer money | Indian agencies do not arrest or settle cases over video calls or ask for transfers |
| Fake customer care | A search result or social media page with a fake helpline number; they ask you to install a screen-sharing app | Never install remote-access apps at a stranger's request |
| Internship / placement fee | "Confirmed offer letter — pay ₹2,999 for training/verification" | Genuine campus and company offers do not charge candidates |
Phishing in the workplace
- Spear phishing — a targeted message using real details (your name, project, manager's name) found on LinkedIn or a company website.
- Business Email Compromise (BEC) — a fake or hijacked "CEO" or "vendor" email asking to change bank details or make an urgent payment.
- Credential phishing — "Your Microsoft 365 password expires today" with a perfect copy of the login page.
- Smishing and vishing — phishing by SMS and by voice call; AI voice cloning makes fake calls more convincing.
- QR code phishing (quishing) — a QR code that leads to a fake login or payment page.
How to check a suspicious message
- Check the sender carefully —
support@hdfcbank-secure.cois not HDFC Bank. Look for misspellings and extra words. - Hover or long-press links to see the real destination before tapping. The domain is the part just before the first single slash —
login.microsoft.com.verify-user.netbelongs toverify-user.net. - Be suspicious of attachments you did not expect, especially .zip, .apk, .exe and Office files asking to "enable content".
- Look for pressure — deadlines, threats, secrecy ("don't tell anyone").
- Verify independently — open the app or type the website yourself; call the known number.
Never install an APK file sent on WhatsApp or SMS — "wedding invitation.apk", "bank update.apk" and "traffic challan.apk" are common ways malware steals OTPs and banking access.
If you have been targeted
- Money lost? Call the national cyber crime helpline 1930 immediately and report at cybercrime.gov.in. Speed matters — funds can sometimes be frozen if reported quickly.
- Call your bank to block cards/UPI and change passwords of affected accounts (from a clean device).
- Report fraudulent calls and messages on the government's Chakshu facility on the Sanchar Saathi portal.
- At work, report phishing to your IT/security team right away — even if you clicked. Early reporting limits damage, and good companies thank you for it.
Try it yourself: Look through your SMS and email spam for three suspicious messages. For each, list the emotional trigger used, the red flags, and where the link really points. Share the exercise with your family — older relatives are frequent targets.
Common interview questions
Try answering each one aloud before you open it.
1What is social engineering?
Manipulating people, rather than technology, into revealing information, granting access or transferring money, using psychological triggers like urgency, fear, authority and trust. Phishing is the most common form.
2What is the difference between phishing and spear phishing?
Phishing sends generic fraudulent messages to many people. Spear phishing targets a specific person or organisation using personalised details, making it more convincing.
3How would you train employees against phishing?
Regular short awareness training with real examples, simulated phishing exercises with immediate feedback, an easy one-click reporting button, a no-blame culture for reporting, and technical controls like email filtering and MFA as backup.
Practise this
Build something with it
FAQs
Can I get hacked just by opening an email?
Rarely on an updated device. The real danger is clicking links, entering credentials, opening unexpected attachments or installing apps. Keep your phone and computer updated.
Is it safe to scan any QR code to receive money?
No. Scanning a QR code and entering your UPI PIN always sends money. You never need to scan or enter a PIN to receive a payment.
References & further reading
Finished this lesson?
Mark it complete. Create a free account to save it on every device.