Phishing Email Anatomy

12: Apple ID locked, Bank OTP, Courier delivery, Electricity bill, Invoice attachment, Job offer, KYC update, Payroll redirect, Sextortion email, Streaming billing, Tax refund, University portal. Pick one at the top of the tool; the page link updates (for example ?v=apple-id-locked) so you can bookmark or share that exact view.

Almost always no. A genuine Apple ID hold is cleared from your own device or at iforgot.apple.com, and Apple's account mail comes from apple.com or icloud.com domains. Check the link's registrable domain — the last two parts of the host, right before the first slash, not the whole host string — and if it is anything other than apple.com or icloud.com (or Apple's other account domains), delete the message.

No. No bank and no bank employee is permitted to ask for an OTP, PIN, CVV or password — by SMS, email or phone. Genuine bank alerts carry the opposite instruction, and any request to share a code is a scam regardless of who the caller claims to be.

No. India Post does not collect redelivery or address-correction fees through an SMS link, and its tracking lives on indiapost.gov.in — a .gov.in address nobody else can register. Any variant asking for card details to release a parcel is a phishing message.

No, when it arrives from a personal mobile number, quotes no consumer number and threatens a cut the same night. Genuine disconnection follows a printed notice with a due date, and discom messages always carry your consumer or CA number and the exact amount due.

Look at the final extension, not the icon. Anything ending .exe, .scr, .js, .vbs, .lnk, .hta, .iso or a macro-enabled Office type (.docm, .xlsm, .xlsb) executes code and has no business being an invoice. Windows hides known extensions by default, so Invoice.pdf.lnk is displayed as Invoice.pdf — check the full name in the attachment properties.

No. Legitimate employers and their recruitment agencies do not charge candidates anything — not registration, training, ID cards, background verification, a laptop or a refundable security deposit. Any fee demand, however small or however it is labelled, means the offer is fraudulent.

No. The Reserve Bank of India holds no individual accounts and never contacts customers about their KYC. Periodic updation is your own bank's obligation, and any message invoking RBI to demand action within hours is a scam.

It is a business email compromise where a fraudster poses as an employee and asks HR or payroll to change the bank account that salary is paid into. No malware is involved — the entire attack is a plausible email, and the loss is the salary itself, usually discovered only when the real employee reports the money never arrived.

Almost certainly not. These campaigns take address-and-password pairs from old website breaches and send millions of identical messages; the password is the only genuine item in the email. If no video or screenshot was actually attached and the message contains nothing personal beyond that password, there is no evidence of any access to your devices.

Check where the button goes: the host immediately before the first single slash must be netflix.com. Netflix's own guidance says it never asks for payment details by email or text, so any message that collects a card number is fake. Open the Netflix app and look at Account, Membership and Billing instead — a genuine failure is shown there.