How can I tell if I am being phished?
Key takeaways
- Check the specific indicators below before assuming the worst — many suspected compromises are something else entirely.
- Preserve evidence before you change anything, because the first change can destroy the proof you need.
- Containment comes before recovery, and recovery comes before cleanup.
- Proof of ownership is required before we work on any account, device or system.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What do the signs usually look like?
These are the indicators we check for. The presence of one is a prompt to look closer, not a diagnosis.
- A message that references a real, recent transaction
- A new bank account detail in an otherwise normal invoice email
- A login page that looks right but is not your provider's domain
- Urgency, confidentiality, or a request to move to a messaging app
- A request for a one-time password, PIN or remote-access tool
- An email address that differs from the sender's real domain by one character
What do you actually do?
We look at the message itself, the sending infrastructure, the links and the landing pages, and we tell you what was harvested and what to do about it. For an organisation, we run a controlled simulation across your staff so you learn where the real risk is.
You get a written record of what was checked, what was found, and what was not found. That last part matters as much as the first two: it tells you which risks you can stop worrying about.
What can you do right now?
- Write down what you have observed and when it started. Timestamps matter more than impressions.
- Do not delete the app, wipe the device, or change passwords in a panic — each of those can destroy evidence.
- If money is at risk, contact your bank first. Most payment fraud is recoverable within hours and not at all after days.
- Preserve the original: the message, the email, the file, the video. Work from a copy.
- If an account is locked, work back to the root account that everything else recovers through.
What does this usually cost, and how long does it take?
The work here is priced as a fixed fee with a stated band, agreed before anything starts, and delivered to a date you can plan around. Where the situation is more urgent than a scheduled engagement allows, tell us and it is handled differently.
| Situation | Typical engagement | Indicative range (ex-GST) | Turnaround |
|---|---|---|---|
| Suspected compromise, nothing lost yet | Device and account security assessment | Rs 40,000 - 1,20,000 | 1-3 working days |
| An account has been taken over | Account recovery and session review | Rs 25,000 - 75,000 | Same day to 2 days |
| Active incident, operations affected | Incident response retainer engagement | Rs 1,50,000 - 8,00,000 | Under 4 hours to engage |
| Ransomware on screen | Containment, evidence preservation and recovery | Rs 1,50,000 - 8,00,000 | Under 4 hours to engage |
| Deepfake or impersonation is spreading | Evidence preservation and platform takedown | Rs 40,000 - 2,00,000 | First notice within hours |
| A repeat or recurring concern | Full assessment with a retest | Rs 60,000 - 3,50,000 | 5-10 working days |
What does this usually cost?
This is a fixed-fee piece of work with a published band and an agreed delivery date, not a day rate that drifts. If what you are dealing with cannot wait for a scheduled slot, say so when you get in touch and we will look at it differently.
Which related services apply?
VAPT & Penetration Testing
Authorised vulnerability assessment and penetration testing for web, mobile, API and network.
Incident Response & Retainer
24/7 help when something is already happening — and a retainer to stop it happening.
Ransomware Recovery & File Unlock
When files are encrypted, the priority is containment first and recovery second.
Website Malware Removal
Blacklisted, defaced, injecting spam, or sending phishing mail from your server.
Deepfake & AI Abuse Protection
Detection, takedown and monitoring for AI face swaps, voice clones and impersonation accounts.
Digital Forensics & Evidence
For the case where it is not a system you own — it is a question you have to answer.
Account Recovery & Data Recovery
Lost or locked accounts, and lost files — recovered with proof of ownership.
Social Media Account Security
Platform-level account security, impersonation removal and audit.
Email Security & Business Email Compromise
The most profitable hack in India right now, and it has nothing to do with malware.
Wi-Fi & Network Monitoring Setup
Home, hotel, café and office wireless — the ones people forget are a perimeter.
Brand Impersonation & Phishing Site Removal
Fake sites that copy your brand and take your customers' money.
Website Security Hardening
The practical, unglamorous work of making a site hard to break into.
Parental Controls & Child Safety
Device monitoring, account safety and evidence, set up lawfully.
Insider Threat & Access Review
When the risk is sitting inside your organisation, wearing a badge.
Third-Party & Vendor Security Risk
Your biggest attack surface is the supplier you have never audited.
People Search & Exposure Check
See what the internet already knows about you or your staff, and cut it down.
What are the common questions about this problem?
Get this checked
Tell us what you are seeing and what is at risk. You will get a straight answer about whether this is something we can help with, and what it would take to settle it.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.