A government logo, a familiar department name and a “secure” padlock can make a webpage look convincing. That is exactly why fake portals work. Fraudsters copy tax pages, recruitment notices, subsidy forms, police notices and payment screens, then push the links through SMS, email, WhatsApp or social media.
On 24 March 2026, PIB Fact Check flagged a fake email claiming to come from the Income Tax Department and described it as a phishing attempt. By 1 April 2026, the unit said it had published 2,913 fact checks, including fake websites and AI-generated material. The safest habit is simple: verify the destination before typing an Aadhaar number, PAN, password, card details, OTP, or UPI PIN.
Fake Government Websites Often Look More Polished Than Expected
Poor spelling is still a warning sign, but it is no longer enough. A copied government site may carry the national emblem, ministry colors, genuine-looking notices and even HTTPS. The lock icon shows that the connection is encrypted; it does not prove the organisation behind the site is genuine.
Instead of trusting appearance, check where the website came from. The National Portal of India web directory maintains links for government bodies and services. Opening a department from that directory is safer than relying on a sponsored search result or a forwarded link.
Before entering personal information, check these details:
- Read the full domain for misspellings, extra words, unusual subdomains or lookalike characters.
- Open the department independently through the National Portal of India or its known official homepage.
- Be suspicious of urgent claims about blocked accounts, refunds, penalties, KYC expiry or “last chance” benefits.
- Avoid shortened links unless the final destination has been verified.
- Never assume a logo, HTTPS padlock or professional design proves government ownership.
CERT-In’s Digital Safety Compass also advises caution around phishing websites, suspicious links and shortened URLs. Government security guidance recommends typing important website addresses directly into the browser instead of opening login links received through messages.
Fraudulent Payment Pages Use Urgency to Stop People From Checking
A payment screen becomes dangerous when it creates pressure. Fake challans, tax dues, electricity penalties, traffic fines, application fees and refund-processing charges may arrive with a deadline designed to make the recipient act first and check later.
If a message claims money is owed to a government department, close the page and find the service again through the department’s official portal. Do not continue merely because the amount looks believable.
NPCI’s fraud-awareness guidance warns users about fake cashback links, QR-code tricks and deceptive payment prompts. A UPI PIN is used to authorise outgoing payments, not to receive money. Someone asking for a PIN, OTP, CVV or screen-sharing access to “complete” a refund is creating a major red flag.
Another useful check is the beneficiary name shown before payment. If it bears no clear connection to the stated department or authorised payment service, stop and verify independently.
Phishing Links Are Getting Harder to Spot in Emails and Messages
Modern phishing may imitate an Income Tax notice, courier alert, bank message, recruitment portal or police communication. In March 2026, PIB Fact Check used its official X account to warn about a fake Income Tax Department email alleging compliance gaps and attempting to lure citizens into clicking.
That warning shows why links should be treated separately from the message around them. A correct logo or sender display name does not make the embedded URL safe.
On phones, press and hold a link to preview its address before opening it. On a computer, hover over it and inspect the destination. Watch for added hyphens, altered spellings and domains that place a government name before an unrelated ending.
Shortened URLs deserve extra caution. CERT-In’s security guidance notes that shortened links can hide phishing or malware destinations. When a notice appears important, searching for the service independently is safer than following the supplied link.
What to Do Before Sharing Details or After Spotting a Suspicious Page
When a government-related claim looks doubtful, PIB Fact Check accepts requests about Union Government ministries, departments, PSUs and organisations. Its official portal and verified social accounts can be used to check suspicious claims.
For suspicious website URLs, phone numbers, email IDs and social-media identifiers, the National Cyber Crime Reporting Portal’s Report Suspect facility allows citizens to submit suspicious identifiers. If money has already been lost, victims are advised to report the incident through the cybercrime portal or call 1930 quickly.
In May 2026, the CBI launched ABHAY, a system for verifying purported CBI notices amid digital-arrest scams. The broader lesson applies elsewhere too: a serious-looking document should be verified through the agency’s own official channel before any payment or disclosure.
FAQs
How can someone verify whether a government website is genuine?
Open the department through India.gov.in, then compare the domain before entering personal or financial details.
Does HTTPS mean a website is officially government-run?
No. HTTPS encrypts the connection, but fraudulent websites can also obtain valid security certificates easily.
What should a person do with a suspicious payment link?
Close it, reopen the service through the portal, and verify the demand before paying anything.
Can a QR code be used to receive a refund?
Receiving money does not require entering a UPI PIN; PIN entry authorises an outgoing payment.
Where can phishing websites or cyber fraud attempts be reported?
Use cybercrime.gov.in for reporting, and call 1930 promptly when financial fraud has already caused loss.
Stay Alert: Scams, Results & Cyber Safety
How Can You Spot Fake Government Ads?
Check out key signs that reveal AI-generated scam advertisements.
How Did This Bank Scam Happen?
Find out how a Mumbai woman reportedly lost ₹4.74 lakh.
How Can You Check CA Results?
See how to access the ICAI May 2026 scorecard online.
Can e-Zero FIR Simplify Cyber Complaints?
Explore how victims may file cybercrime complaints without travelling.
What Should Bank Customers Check?
Look into what customers should review after the reported data breach claim.
