Tech Original explainer
Most hacks start with a message, not a mastermind. How phishing works and the habits that keep you safe.
Most cyberattacks do not start with a hacker in a dark room breaking into a computer. They start with a message. A text saying your bank account will be blocked. An email that looks like it came from your office. A call from someone claiming to be a police officer. You tap a link, or share a code, and the attacker walks in through the front door. That is the reality of cybersecurity today: the weakest point is usually not the technology. It is us.
Cybersecurity means protecting your devices, your accounts and your money from people who want to steal them. The threats have ordinary names. Phishing is a fake message designed to trick you into handing over a password or a one-time code. Malware is software that harms your device or spies on you, often hidden inside a free app or a pirated download. Ransomware locks your files and demands payment to unlock them. And identity theft is when someone uses your details — your name, your number, your documents — to pretend to be you.
A phishing message works because it creates urgency. Your account will be closed in two hours. A parcel is waiting and needs a small fee. A job offer needs your bank details today. The message looks real because it copies real logos and real language, and it often knows your name. The link takes you to a page that looks exactly like your bank's site, where you type your password — and the attacker collects it. Or the message asks for the one-time password your bank just sent you. That code is the last line of defence. The moment you share it, the attacker can log in as you.
Phone calls work the same way. A caller claims to be from the bank, the police, or a courier company, and asks you to install an app or share your screen. The app gives them control of your phone. Or they ask you to transfer a small amount to verify your account, and then a larger one. The pattern is always the same: fear, urgency, and a request to act now. A real bank will never ask for your password or your one-time code. A real police officer will never ask you to transfer money. If a message makes you panic, that is the point. Stop, and check through a different channel.
Your password is the key to your accounts, and most people still use the same key everywhere. That is the single biggest mistake in personal cybersecurity. If one website leaks its database — and leaks happen constantly — the attacker tries the same password on your email, your bank, and your shopping accounts. The fix is simple and boring: a different password for every important account. You cannot remember them all, and you should not try. Use a password manager, or at least write them down somewhere safe that is not your phone.
The second habit is two-factor authentication: after your password, the service asks for a second proof, usually a code from an app or a text message. It is a small inconvenience that stops most attacks, because even with your password, the attacker does not have your phone. Switch it on for your email, your bank, and your UPI apps first. The third habit is updates. Those software updates on your phone are not just new features. They close security holes that attackers are already using. Install them promptly, and do not install apps from outside the official stores.
If you lose money to online fraud, speed matters more than anything. Call 1930 immediately — it is India's national helpline for cyber financial fraud, run by the Indian Cyber Crime Coordination Centre under the Ministry of Home Affairs. It works round the clock, and the faster you call, the better the chance that your bank can freeze the transaction before the money moves on. You can also report the crime on the National Cyber Crime Reporting Portal at cybercrime.gov.in, which gives you an acknowledgement number that banks and police ask for. For incidents affecting an organisation, the Indian Computer Emergency Response Team, CERT-In, can be reached at 1800-11-4949, and organisations are required to report serious incidents within six hours of noticing them.
The scale of the problem is large. According to the government, the fraud reporting system had helped save more than 8,690 crore rupees across more than 24.65 lakh complaints by the end of January 2026. That number is both reassuring and alarming: the system works, but the fraud is enormous. The best time to learn the reporting process is before you need it. Save the number 1930 in your phone now, and tell your parents to do the same.
You do not need to become a security expert. You need a few reflexes. Do not click links in unexpected messages — open the app yourself instead. Do not share one-time codes with anyone, ever, for any reason. Do not install apps that strangers recommend on a call. Check the sender's address, not just the display name. And if something feels off, it probably is: stop, wait, and ask someone you trust. The attackers are not smarter than you. They are just patient, and they send the same message to a million people, waiting for the few who are tired, rushed, or scared. Your job is not to be one of them.
This explainer was written by The Daily Short's desk from the sources listed above. It is general information, not professional advice. Spot an error? See our Corrections Policy or tell us via the Contact page and we will correct it. Follow our official Instagram @thedaily.short.