Channel discipline
Banks rarely ask for OTPs over WhatsApp—when in doubt, open the official app cold.
URL forensics
Punycode domains and lookalike TLS certs fool busy thumbs—bookmark real portals.
Collective defense
Telcos sharing hash blocklists blunt blast campaigns faster than individual blocks.
