KYC Update SMS Scam: How to Spot a Fake Bank Message and Stay Safe
KYC update SMS fake hai ya real?
Banks do need to refresh your KYC from time to time, so a reminder in itself is not proof of fraud. What gives the scam away is the combination: a threat that your account will be blocked today, a link to click, and a request for your login details, card number or OTP.
Real banks ask you to update KYC through their official app, internet banking that you open yourself, or at the branch. They do not send a shortened link from a 10-digit mobile number and threaten to freeze your account by midnight.
| Genuine bank reminder | Scam message |
|---|---|
| From the bank’s sender ID, or inside the bank app | From a 10-digit mobile number or an unknown WhatsApp account |
| Asks you to visit the branch or use the official app | Asks you to click a link right now |
| Gives a reasonable time to act | “Your account will be blocked today” or “within 24 hours” |
| Never asks for OTP, PIN, CVV or password | The page asks for customer ID, password, card details, then an OTP |
| Website ends in .bank.in | Lookalike address such as sbi-yono-kyc.xyz or a bit.ly link |
How does the KYC update scam work?
- You get an SMS or WhatsApp saying your account, card, YONO or PAN link has expired and will be blocked.
- The link opens a page that copies your bank’s logo and colours almost perfectly.
- You type your customer ID and password, then card number and expiry date “to verify”.
- An OTP arrives. The page asks for it. That OTP actually approves a payment, adds a new beneficiary or registers the scammer’s phone on your account.
- Money leaves your account within minutes, often in several small transfers.
Some versions ask you to install an “update” app (an APK file) instead. That app can read your SMS, including every future OTP. Never install apps from a link in a message.
How to check if a bank link is real
Read the web address from the right, not the left. The real owner of a site is the part just before the first single slash. Indian banks have moved their websites to the .bank.in domain, so a genuine address looks like sbi.bank.in, not sbi-kyc-update.com.
- Shortened links (bit.ly and similar) hide the real address. Treat them as unsafe.
- Spelling tricks are common: “hdfcbnak”, “icici-secure-login”, extra hyphens or numbers.
- A padlock icon only means the connection is encrypted. Scam sites have padlocks too.
- The safest habit is simple: never log in from a link. Open the app you already have or type the address yourself.
TipCalls matter too. Regulated banks and insurers use 1600-series numbers for service calls, while 140-series numbers are for promotions. A “bank” call from an ordinary mobile number deserves extra suspicion.
Paste the KYC message into the Scam CheckerIt checks links, sender and wording on your deviceOpen →KYC link par click kar diya, ab kya kare?
What to do depends on how far you went. Act calmly but quickly:
| What happened | Do this now |
|---|---|
| Clicked, but typed nothing | Close the page and delete the message. Report the SMS on Chakshu. |
| Typed your password or card details | From a safe device, change your net banking password, and call your bank on the number printed on your card to block the card and UPI. |
| Shared an OTP | Call your bank immediately to block cards, UPI and net banking. Check your statement for any transfer. |
| Installed an app from the link | Turn on airplane mode, uninstall the app, call your bank, then change passwords from another device. |
| Money has gone | Call 1930 at once and report on cybercrime.gov.in with the transaction IDs. Then inform your bank in writing. |
Under RBI rules on unauthorised electronic transactions, telling your bank quickly matters. Where the fault is neither yours nor the bank’s, reporting within three working days limits your liability. The sooner you report, the better your position, so do not wait to see if the money comes back. Our first hour after cyber fraud guide lists everything to keep ready.
How to stop KYC fraud before it starts
- Keep your bank’s official app updated and use it for anything KYC related.
- Turn on transaction alerts so you know within seconds if money moves.
- Never share an OTP, UPI PIN, CVV or password with anyone, including people who say they are bank staff.
- Report every fake KYC message on Chakshu (sancharsaathi.gov.in/sfc), even if you ignored it. Reports from the last 30 days are accepted.
- Help older relatives set up the bank app and show them where the real helpline number is.
The Digital Suraksha course has a short lesson on spotting fake links that is worth sharing in family WhatsApp groups.
PAN, Aadhaar and wallet KYC messages: same trick, new names
The KYC scam is not limited to bank accounts. The same script appears with different labels, and the answer is the same every time: go to the official app or website yourself instead of the link.
- PAN not linked. “Your account will be frozen because PAN is not updated.” Check PAN status only on the official income tax portal you open yourself.
- Wallet or payment app KYC. “Your wallet KYC has expired, balance will be lost.” Open the wallet app directly; real KYC prompts appear inside it.
- SIM KYC. “Your SIM will be blocked in 24 hours, call this number.” Mobile operators handle SIM issues in their own app or store.
- Credit card points. “Your reward points expire today, redeem now.” The link collects card details and OTPs.
If a message makes you feel you must act within minutes, that pressure itself is the warning sign.
Frequently asked questions
Does SBI send KYC update links by SMS?
Banks may remind you that periodic KYC is due, but they ask you to use the official app, website or branch. They do not threaten to block your account today through a link sent from a mobile number.
How do I know a bank website is real?
Look at the part just before the first single slash in the address. Indian banks have moved to the .bank.in domain. Anything like sbi-kyc.xyz or a shortened link is not your bank.
I shared an OTP on a KYC page. What now?
Call your bank immediately on the number printed on your card to block cards, UPI and net banking. If money has gone, call 1930 and report on cybercrime.gov.in with the transaction IDs.
Will my account really be blocked if I ignore the SMS?
Not because of a scam SMS. If your KYC is genuinely due, your bank app or branch will tell you, usually with time to complete it. Check there instead of using the link.
Where do I report a fake KYC SMS?
Report it on Chakshu at sancharsaathi.gov.in/sfc, then block the sender and delete the message. If you lost money, the report goes to 1930 and cybercrime.gov.in instead.
Sources
- National Cyber Crime Reporting Portal (helpline 1930), Ministry of Home Affairs
- Sanchar Saathi: Chakshu, report suspected fraud calls, SMS and WhatsApp messages
- RBI: limiting customer liability in unauthorised electronic banking transactions
- Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs
Last checked: . Rules, amounts and dates change. Please confirm on the official website before you act.
This guide is general safety information, not legal advice. Helplines, portals and bank rules can change: follow the instructions of your bank, the police and cybercrime.gov.in.