Net Banking Phishing Site Scam

A link in an SMS or email opens a copy of your bank's login page that steals your user ID, password and OTP, then empties your account.

You tap a link in a message that says your account needs action, and a page opens that looks exactly like your bank's net banking login. You type your user ID and password, and the page asks for an OTP. The page is a copy. Everything you type goes to the scammer, who logs in to your real account at the same moment and approves transfers.

How the scam works

The scammer builds a page using your bank's logo, colours and wording and registers a web address that looks similar, with a swapped letter, an extra word or a different ending. They send it through SMS, email or ads that say there is a reward, a blocked account or a pending tax refund. Links are often shortened, so you cannot see where they lead.

When you enter your login details, the fake page forwards them to the real bank in the background and asks for the OTP that the bank sends. This happens live, so the OTP you type is valid. Some pages also ask for your card number, PIN and CVV 'for verification', which gives the scammer even more ways to take money.

The scammer uses your credentials and OTP to add a new payee or send money directly. A message of a transfer may arrive on your phone at the same time, but you often see it only after the page shows a harmless 'thank you' screen. The money moves onward quickly, making it hard to trace and harder to get back.

An example of what you may see

Example only: 'Dear customer, your net banking will be suspended due to incomplete verification. Log in now at the link below to keep your account active. Failure to do so will block your account within 24 hours. Enter your user ID, password and the OTP sent to your phone.' The link has a bank name followed by a word like 'secure' and an unusual ending. The page loads fast, shows your bank's logo and even a security note, but the address in the top bar is not your bank's own.

This example is written for illustration. Real messages change their wording, names and links all the time.

Red flags

• A link in a message asks you to log in to your bank.
• The web address has extra words, letters or an unusual ending.
• The page asks for card PIN, CVV and an OTP together.
• The message threatens suspension within hours.
• The sender is an ordinary mobile number or odd email address.
• The page has small spelling mistakes or an unusual layout.

What to do right now

1. Close the page without typing anything.
2. Type your bank's address by hand or use the official app to log in.
3. Do not log in from a link in a message.
4. Delete the message and report it to your bank.
5. Report the SMS number on the Sanchar Saathi portal.

If you already paid or shared a code

1. Call 1930 right away and give the amount, time and transaction details.
2. Call your bank on the number on your card or passbook and block net banking and cards.
3. Change your net banking password and UPI PIN from a safe device.
4. Report at https://cybercrime.gov.in with the link and screenshots.

National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.

Where this scam shows up

Read how it looks on each channel:

How Safeavio helps

Safeavio's link check lets you paste or share a link before opening it and looks for lookalike domains, shortened links and risky patterns, and the scam check shows why the message looks like pressure and fake authority. It cannot tell if a page is truly your bank's, so open your bank's official app or type the address yourself. Type the address yourself.

• Phishing checks
• Link and browser safety

Questions people ask

Other scams in this group

Also known as: fake bank login page, net banking password fraud, bank website clone. More bank and card fraud