I got a "your card has been cancelled" email for a card I never had. Is it phishing?

It can be any of three things: phishing, a bank sending emails to the wrong customer, or a card application made in your name. Here's how to tell:

1. Check whether it's genuine. In Gmail, open the message, choose Show original, and look at the SPF, DKIM and DMARC results. If all three pass for the bank's real domain, the email genuinely came from the bank, so it isn't phishing, even if the bank later calls it "spam".
2. Look at the sender address. Words like "UAT" or "test" in it suggest a test system sending real emails, which is worth raising with the bank.
3. Don't click links or call numbers in the email. Use the bank's official website or app.
4. Check your credit report for a new account or a recent hard enquiry from that bank. If one is there, someone may have applied in your name, so dispute it immediately.
5. Report it to the bank in writing, quoting the masked card number from the email and asking them to (a) confirm whether any account exists in your name, (b) remove your email from any record that isn't yours, and (c) give you a complaint reference number.

If the bank closes the complaint without investigating, escalate to its Principal Nodal Officer and then the RBI Ombudsman.