IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Spotting phishing and fake logins
Maya gets an SMS: "Your bank account will be blocked today. Tap here to update." She feels scared and her thumb moves. Your goal: spot a fake message or a fake login page before you tap, type or share anything.
- Phishing is a fake message that tricks you into tapping a link or giving a secret.
- Read a link from the right. The last two parts before the first slash are the real domain.
- The padlock means a private line, not an honest site.
- Never read an OTP to someone who calls or messages you. A real bank never asks for it.
- If you tapped by mistake, act fast and tell someone.
What phishing is
Phishing (say "FISH-ing") is a fake message that tricks you. The thief throws out bait, like a fisherman. It comes by SMS, email, WhatsApp or a phone call. It wants a tap on a link, or a secret like your password or an OTP (a one-time code).
Tricking a person, not a computer, is called social engineering.
Read the link from the right
In lesson 1 you met the URL and its domain. A thief makes a link that looks right at a quick glance. Check it the careful way. Find the first slash after https://. The last two parts just before it are the real domain. Everything on the left is only decoration. A subdomain is a name added in front, like netbanking.yourbank.example. A thief who owns login-check.co can put any name in front of it.
| Link | Real domain | Verdict |
|---|---|---|
https://netbanking.yourbank.example/login | yourbank.example | Real. "netbanking" is a subdomain. |
https://yourbank.example.login-check.co/signin | login-check.co | Fake. The bank's name is only stuck in front. |
https://yourbnak.example/login | yourbnak.example | Fake. Two letters are swapped. |
login-check.co, a stranger's.The padlock does not mean honest
The padlock means your line to the site is private (lesson 6). It says nothing about who owns the site. A thief can get a padlock for a look-alike domain the thief owns. Check the domain, not the lock.
Never read out an OTP
An OTP is a key for one thing that you started. A real bank, shop or officer never asks you to read it out. Not on a call. Not on chat. Not even "to cancel" something. If a caller or a message asks, the answer is no.
Scams you may meet
Fake "KYC updates", "stuck parcel" fees, "bank" or "police" callers, prizes and job offers that want a fee: all use fear or greed. They say hurry. Slow down. Four examples are in Go deeper below.
the watchman at a society gate. A stranger says: "I am from the bank. Let me in now. Do not call anyone." A good watchman calls the flat owner first. You do the same. Hang up. Call the number on the back of your own card.
What protects you
- A password manager fills your password only on the exact site where you saved it. On a look-alike it stays empty. That is your alarm.
- A passkey works only for the real domain. On a fake page it does nothing, and there is nothing to type.
- MFA adds a second proof. It helps, but an OTP can still be tricked out of you.
- Skip the link. Open the app yourself, or use your bookmark.
If you already tapped or shared
- Stop. Type nothing more. At work? Tell your security team at once.
- Typed a password on a fake page? Change it now, from the real app. Change it on every site that shares it.
- Turn on MFA for that account.
- Shared an OTP or lost money? Call your bank on the number on your card. Ask to block the card or account. In India, also call 1930 or report at cybercrime.gov.in.
- Locked out of your account? See account recovery.
Go deeper: Four common scams
- The "KYC update" SMS. "Your KYC has expired. Update now or your account is frozen."
- The "parcel is stuck" message. "Pay ₹29 to release it." You may not even expect a parcel.
- The caller who says "bank" or "police". The caller asks for your OTP. Or the caller asks you to install a screen-share app, which lets the caller watch your phone. The caller also says "tell nobody."
- The prize or job offer. You must pay a small fee first.
Go deeper: more tricks and why fakes still work
Some endings, like .co.in or .co.uk, use three parts as the real domain. The rule still holds. The real domain is the name just left of the ending the registry sells.
Letters can fool the eye. An "rn" looks like an "m". A zero looks like an "o". Some links also show one address but open another. On a computer, hover over the link. On a phone, press and hold it.
Some fake pages are smarter. They sit between you and the real site. They pass your password and your OTP along in real time. This is called adversary-in-the-middle phishing. You can read how it works in AiTM phishing. Passkeys beat it because they refuse to work on the wrong domain.
🧪 Interactive lab — enable JavaScript to play with this one.
See how a short link hops to its real end address. Try a normal link in Redirect Check. Never test a link you think is a scam.