Phishing Emails & Fake Exchange Sites: India Safety Guide

A phishing email looks exactly like a message from your crypto exchange. The logo is right, the layout is right, and the warning sounds urgent: your KYC is about to expire, a withdrawal needs your approval, or your account will be frozen in 24 hours. You click, you log in, and nothing seems wrong — until your balance is gone. Phishing emails and fake exchange websites are the most common way beginners lose crypto, not because the technology failed, but because a convincing copy of a trusted site tricked a real person.

The good news is that these attacks follow predictable patterns. Once you know what they look like, most of them become easy to spot — and the few that still slip through can be stopped by one simple habit: never log in through a link someone sent you.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose.

What a Phishing Attack Actually Is

Phishing is impersonation with a purpose. The attacker pretends to be a company you trust — your exchange, your wallet provider, or even a tax authority — and tries to get you to hand over something valuable: your password, a one-time code, your recovery phrase, or a payment.

The classic version arrives by email, but Indian users now meet the same trick on SMS, WhatsApp, Telegram, and even search-engine ads. A fake support agent on Telegram, a sponsored result that looks like your exchange, and a "refund" message on WhatsApp are all the same attack wearing different clothes. The channel changes; the goal does not.

Here is the key point beginners often miss: a phishing site does not need to hack the exchange. It only needs to look enough like it that you type your own credentials into the wrong box. From that moment, the attacker simply logs into your real account with your real password.

The Five Phishing Stories Aimed at Indians

Scammers reuse a small set of stories because they work. If a message matches one of these, slow down before doing anything.

1. "Your KYC will expire." The message claims your account will be frozen unless you re-verify your PAN or Aadhaar immediately. Real Indian exchanges do ask for KYC, but they do so inside their app, not through an emailed link demanding documents on a deadline. This story works because KYC is genuinely mandatory in India, so the threat feels plausible.

2. "A withdrawal needs your approval." You get an alert about a withdrawal you never made, with a big button to "cancel" it. Clicking takes you to a fake login page. The panic of an unauthorised withdrawal makes people act before thinking — which is exactly the point.

3. "Claim your refund or TDS credit." A message promises a tax refund, a TDS reversal, or a government subsidy on your crypto holdings. Tax-related bait is especially effective in India around filing season, when people genuinely expect messages from tax portals. No exchange or tax department returns crypto through a link in a random message.

4. "Your account is frozen — verify to unlock." Similar to the KYC story, but with a locked account and a countdown timer. Urgency is the weapon here: a timer stops you from checking the sender's address or typing the real website yourself.

5. "Double your crypto giveaway." A celebrity, an exchange founder, or a fake support account promises to double any crypto sent to a wallet address. Legitimate companies never run giveaways that ask you to send funds first. This one is not even phishing in the strict sense — it is a straight theft — but it travels through the same fake pages and impersonator accounts.

How a Fake Exchange Website Fools You

A fake exchange website is a near-perfect copy of the real one, built to harvest logins. The tricks are small, and that is why they work:

• A lookalike domain. The address might swap one letter, add a word, or use a different ending — for example, an extra hyphen, a misspelling you read past quickly, or a ".net" where the real site uses ".com". On a phone screen, where the full address is often hidden, these are easy to miss.
• A paid ad at the top of search results. Scammers buy ads on the exchange's own name, so the fake site appears above the real one. The word "Ad" next to the result is the only visible clue.
• A stolen design. Logos, colours, fonts, and even help articles are copied directly from the real site. A professional look proves nothing — copying a design costs the scammer nothing.
• A fake login that "works". You type your email and password, and the fake site shows a loading screen, an error, or a fake dashboard. Meanwhile your credentials have already been sent to the attacker, who logs into the real site within minutes.
• A fake app download. Some fake sites push you to install an "updated" app from outside the Play Store or App Store. That app is malware: it can read OTPs, overlay fake screens, or steal wallet data.

One more trap deserves attention: fake customer support. Search results and social media are full of phone numbers and Telegram handles claiming to be exchange support. Real exchanges handle support inside the app or on their verified website — never through a WhatsApp number found in a search result.

Eight Red Flags to Check Before You Click

You do not need technical skills to spot most phishing attempts. Run through this list whenever a message asks you to log in, verify, or pay:

Red flag	What it looks like
Urgency and threats	"Frozen in 24 hours", "last chance", a countdown timer
A link you did not request	Any login, KYC, or refund link in email, SMS, or chat
A slightly wrong address	Misspellings, extra words, or an unusual domain ending
Requests for secrets	Password, OTP, PIN, or seed phrase asked by message
Generic greetings	"Dear user" or "Dear customer" instead of your name
Unexpected attachments	A "KYC form" or "statement" file you did not ask for
Too-good offers	Free crypto, doubled returns, or guaranteed refunds
A new support channel	Help offered only on WhatsApp, Telegram, or a personal number

Any single red flag is reason enough to stop and verify through another route. Two or more, and you can safely assume the message is fake.

The Two-Minute Verification Check

When a message claims something about your account, do this instead of clicking:

1. Close the message. Do not click its links, buttons, or attachments — not even to "unsubscribe".
2. Open the app yourself. Use the exchange app already installed on your phone, or type the exchange's address into your browser yourself. Bookmark the real site once, and use the bookmark every time.
3. Check inside the app. Real alerts — a pending KYC step, a withdrawal notice, a security warning — appear in the app's notification centre. If the message is not there, it did not come from your exchange.
4. Compare the sender. On email, tap the sender's name to reveal the full address. A real exchange sends from its own domain; a scammer sends from a lookalike domain or a free mailbox.
5. Search the claim, not the link. If a message claims a new rule or offer, search for it on the exchange's official blog or verified social account. Genuine announcements appear there first.

This routine takes about two minutes, and it defeats nearly every phishing attempt, because phishing only works when you follow the attacker's path instead of your own.

What to Do If You Clicked or Entered Details

Mistakes happen, and speed matters more than embarrassment. Work through these steps in order:

1. Change your password immediately on the real exchange, from the official app. Choose a password you do not use anywhere else.
2. Turn on authenticator-based two-factor authentication if it is not already on, and replace SMS codes where the exchange allows it. An authenticator app generates codes on your own phone, so they cannot be intercepted the way SMS codes can.
3. End all sessions and check activity. Most exchanges show active devices and recent logins. Sign out everywhere, then review withdrawals and API keys, and revoke anything you do not recognise.
4. Secure your email account next. If the attacker has your email password, they can reset other accounts. Change that password too, and turn on two-factor authentication for email as well.
5. If crypto was sent out, preserve the evidence. Save the transaction ID, the destination address, screenshots of the fake site or message, and the time it happened. Then report it — details below.
6. Do not pay a "recovery service". Anyone who contacts you offering to recover stolen crypto for a fee is running a follow-up scam. Legitimate recovery is not sold this way.

What Legitimate Exchanges Will Never Ask You For

This short list is worth memorising, because it ends most phishing conversations instantly. A real exchange will never ask you for your password, your OTP, your recovery phrase, or remote access to your phone or computer — not by email, SMS, WhatsApp, Telegram, or phone call. It will never ask you to install an app from a link, send crypto to "verify" your wallet, or pay a fee to unlock a frozen account.

Anyone asking for one of these things is not support staff having a bad day. They are a scammer, and the correct response is to end the conversation and report the account.

Building Habits That Make Phishing Hard

Blocking one attack is good; making yourself a hard target is better. A few habits do most of the work:

• Bookmark the real sites. Use bookmarks or the official app for every exchange and wallet you use, and never arrive by a search result or a message link.
• Use an authenticator app and a unique password. A password manager helps here: it will not autofill your credentials on a fake domain, because the domain does not match. That silent refusal is a free warning.
• Keep a separate email for crypto. An email address used only for exchanges limits the damage if your everyday inbox is ever exposed, and makes phishing easier to spot — a "crypto" message landing in your main inbox is immediately suspicious.
• Use withdrawal address whitelisting if your exchange offers it. Whitelisting means withdrawals can only go to addresses you approved in advance, usually after a waiting period. Even if an attacker logs in, they cannot instantly send funds somewhere new.
• Keep records of everything. Your own transaction history, withdrawal confirmations, and tax documents matter twice over in India: for filing, and as evidence if you ever need to report fraud.

Tax note: crypto tax rules can change — the 30% rate and 1% TDS described here were current as of September 2026. Verify the latest rules before filing. Keep your own records regardless of what any platform provides, because a phishing incident can lock you out of an account and its statements at the worst possible time.

How to Report Crypto Fraud in India

Reporting rarely recovers funds, but it still matters: reports build the cases that shut down scam networks, and your exchange and bank need a record for their own investigations.

• Your exchange first. Report through the official app's support section, with the fake site's address, screenshots, and transaction IDs. Ask them to flag the destination wallet and freeze anything still under their control.
• National Cybercrime Reporting Portal at cybercrime.gov.in, or the helpline number 1930 for urgent financial fraud. File as soon as possible — the first hours matter most for any chance of freezing linked bank accounts.
• Your bank, if any INR left your bank account — for example, a UPI payment to a scammer. Ask about recall or freeze options immediately.
• The platform hosting the scam. Report fake ads to the search engine or social platform, and fake accounts to the platform itself. One report removes one trap for the next person.

The Bottom Line

Phishing succeeds through urgency, familiarity, and one careless click — not through unbeatable technology. The defence is equally simple and entirely in your hands: never log in through a link someone sent you, verify every alarming message inside the official app, and treat any request for a password, OTP, or seed phrase as proof of a scam.

Make the two-minute check a reflex, bookmark the real sites, switch on authenticator-based two-factor authentication, and keep a separate email for crypto. Those four habits cost nothing, take an afternoon to set up, and protect every rupee and coin you hold far better than any recovery promise ever could.

Next step: Open your exchange app now, check that authenticator-based two-factor authentication is on, and bookmark the real website — before the next urgent message arrives.