How to read an SMS sender header and spot a phishing message
What an SMS sender ID or header tells you, why it is not proof, and how to judge a bank or delivery message before you act on it.
In India, business SMS usually arrive from a short sender name rather than a mobile number, such as an ID with letters and a dash. This is the header. It can help, but it does not prove a message is real. Scammers also use look-alike headers or send from ordinary numbers. Here is how to read a message calmly.
Steps
- Look at the sender first. A message from a mobile number claiming to be a bank, courier or government office is suspicious, because genuine business messages normally come from a named header, not a personal number.
- Do not treat a header as proof. A neat-looking header does not guarantee the message is true. Scammers can send messages that appear in the same thread as real ones, so judge the content as well.
- Read for pressure. Look for urgency, threats, account closure, KYC expiry, a pending parcel fee or a prize. Real organisations may send alerts, but they do not demand action within minutes through an odd link.
- Check the link without tapping it. Look at the web address in the message. Watch for short links, strange endings or extra words. Do not tap. Type the official site yourself or open the official app instead.
- Compare with your own records. Open your bank or courier app, or check your bill or order list. If there is no matching issue there, the message is very likely a phishing attempt.
- Report and delete. You can report suspicious SMS and WhatsApp numbers on the Sanchar Saathi portal under the Chakshu facility. Then delete the message. Menu names differ slightly on Samsung, Xiaomi, Vivo, Oppo, Realme and OnePlus phones.
Menu names differ a little between phone makers and Android versions. If you cannot find a setting, open Settings and use the search box.
Why it matters
One tap on a phishing link can lead to a fake page that steals your login, card or OTP. The header gives a clue, but the content and the link matter more. Learning to read both quickly makes you much harder to trick, even when a message looks official. This is especially useful for messages about KYC, courier fees and challans.
Watch out for
- Never share an OTP in reply to any message.
- Do not call a number given inside a suspicious message.
- A message in the same thread as real alerts can still be fake.
- A message asking you to install an app is a strong warning.
How Safeavio helps
Safeavio's scam check lets you paste or share an SMS to get a plain verdict with the reasons, such as urgency, money demands, fake authority and OTP asks. Its link check looks at the address. It does not read your messages on its own, and it cannot guarantee a result.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions
Can a scammer's SMS appear under my bank's real name?
Sometimes messages can seem to appear in the same thread as genuine ones, so never rely on the sender name alone. Judge the request itself and check inside the official app or with the number on your card.
What should I do if I already tapped the link?
Do not enter any details. Close the page, and if you did enter anything, change the password at once and tell your bank using the number on your card. If money moved, call 1930 and report at cybercrime.gov.in.