KYC update SMS: banks don’t block accounts through a link in a text
A message saying your bank, YONO, Paytm or PAN KYC has expired and your account will be blocked unless you update it through a link is almost always phishing. The link opens a fake bank page that asks for your login, card details and OTP, and the money is taken in minutes.
Banks do KYC in their own app or at the branch, and Indian banks’ websites now end in .bank.in. Don’t click the link; open your bank’s app yourself or call the number on your card.
Last updated: Reviewed by IndiaDigital editorsSources
How does this scam work?
- An SMS or WhatsApp says your account, card or YONO will be blocked today because KYC or PAN is pending.
- The link looks official (sbi-kyc-update, hdfc-netbanking-verify) but ends in something else, or it is a shortened bit.ly link.
- The fake page asks for your customer ID, password, card number, then an OTP “to verify”.
- That OTP actually approves a payment or adds the scammer’s device to your account.
Real-style examples
Numbers and links are changed. The red flags are marked by the same engine that runs in the Scam Checker.
Dear Customer, your SBI YONO account will be blocked today. Please update your PAN card immediately: http://sbi-yono-kyc.xyz/update
- Fake brand website
- KYC / PAN / Aadhaar update request
- Says your account will be blocked
HDFC Bank: Your NetBanking access is suspended. Re-verify now at https://hdfcbnak-secure.com/login
- Fake brand website
- Says your account will be blocked
- Pressure plus a request
प्रिय ग्राहक, आपका बैंक खाता आज रात बंद हो जाएगा। तुरंत अपना केवाईसी अपडेट करें: bit.ly/sbi-kyc-upd
- KYC / PAN / Aadhaar update request
- Says your account will be blocked
- Shortened link hides the real address
Red flags: how to spot it
- A deadline: today, tonight, within 24 hours
- A link that is not your bank’s real site, or a shortened link
- Sent from a 10-digit mobile number instead of a bank sender ID
- Asks for password, card number, CVV or OTP
How to check if it is real
- Read the address from the end: the real site is what comes just before .com, .co.in or .bank.in.
- Open the bank app you already have and see if anything is pending.
- Call the number printed on your debit card.
- Paste the message into the Scam Checker to see the warning signs.
What to do if you get one
- Clicked and typed details? Change your net banking password from a safe device and call your bank to block cards and UPI.
- Lost money? Call 1930 at once and report on cybercrime.gov.in.
- Report the SMS on Chakshu and delete it.
Remember: Banks never ask you to update KYC through an SMS link. KYC is done in the official app or at the branch.
Lost money? What to do in the first hour
- Call 1930 now. The National Cyber Crime Helpline. The first hour matters most: a quick report lets banks try to hold the money before it moves on.
- File the complaint on cybercrime.gov.in. Add the transaction ID or UTR, amount, time, the UPI ID or account the money went to, and screenshots. Note your complaint number.
- Tell your bank and freeze cards and UPI. Call the number on your card or in the bank app. Reporting within 3 working days can limit your liability under RBI rules.
- Keep the evidence, beware “recovery agents”. Don’t delete chats. Anyone who charges a fee to get your money back is running a second scam.
Frequently asked questions
Does SBI send KYC update links by SMS?
Banks may remind you that periodic KYC is due, but they ask you to use their official app, website or branch. They do not threaten to block your account today through a link from a mobile number.
How do I know a bank website is real?
Look at the part just before the first single slash. Indian banks have moved to the .bank.in domain (for example sbi.bank.in). Anything like sbi-kyc.xyz or a shortened link is not your bank.
I shared an OTP on a KYC page. What now?
Call your bank immediately on its official number to block cards, UPI and net banking. If money has gone, call 1930 and report on cybercrime.gov.in.
Related scams
Sources
National Cyber Crime Reporting Portal (1930) · Sanchar Saathi: Chakshu, report suspected fraud communication · RBI: limiting customer liability in unauthorised electronic banking transactions