Electricity Bill Payment Phishing SMS — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 25, 2026

Severity: HIGH | View Full Scam Details

Beware of Electricity Bill Payment Phishing SMS in India 2026: How Scammers Trap You Through Fake UPI Links

Every month, thousands of Indians receive fake SMS messages warning about urgent electricity bill payments to steal their money and personal data.

What Is the Electricity Bill Payment Phishing SMS?

Electricity Bill Payment Phishing SMS is a growing cyber fraud in India where scammers send fake text messages pretending to be from legitimate electricity providers. These messages claim your bill is overdue and that urgent payment is required to avoid service disconnection. The SMS often includes a fraudulent payment link that directs you to a fake UPI or payment page.

This scam primarily targets everyday Indian consumers — especially in metro and tier-2 cities — who regularly pay electricity bills online using UPI apps like Google Pay, PhonePe, or Paytm. The scam gains momentum toward the end of each month, when bill payments pile up and people rush to clear dues. Its spread is so extensive that CERT-In (Computer Emergency Response Team of India) and the Indian government’s I4C (Indian Cybercrime Coordination Centre) have issued warnings to consumers.

According to RBI guidelines, users should never share UPI PINs or OTPs sent via SMS. This scam exploits both psychological pressure and technical gaps to bypass basic security awareness.

How This Scam Works — Step by Step

1. Scammer Harvests Numbers: Using publicly available mobile directories or data leaks, fraudsters collect phone numbers linked to electricity consumers.

2. Fake SMS Sent: Just before or after the bill due date, victims receive a message like:
   “Your electricity bill INR 1,500 is overdue. Pay now at [fake link]. Pay before midnight to avoid disconnection.”

3. Victim Clicks Link: The link appears official but leads to a cloned payment page mimicking UPI apps or the electricity board’s website.

4. Data Capture: When the victim enters UPI ID, bank details, or OTPs, attackers record this sensitive data.

5. Unauthorized Transaction: Using the stolen information, scammers initiate fraudulent transactions, transferring money out of the victim’s bank account instantly.

6. Victim Notices Loss: Later, the victim finds unexplained debits on their bank statement or UPI app and realizes the scam.

7. No Reversal or Delay: Due to instant UPI payments and lack of OTP double verification, the money is gone. Victims struggle to get refunds.

Real Warning Signs to Watch For

• SMS sender’s number is a random 10-digit number, not the official electricity provider ID.
• Message has spelling or grammar errors or unusual formatting.
• Urgent or threatening tone like “pay NOW or service will be cut off.”
• Payment link URL looks suspicious — includes strange domain names or extra characters.
• Requests personal data such as UPI Pin, OTP, Aadhaar number, or bank details.
• Message arrives unexpectedly, or earlier than usual bill reminders from your provider.
• You receive the message multiple times within a short period, increasing pressure.

What Happens to Victims

Victims often endure serious financial loss. Since UPI payments happen instantly, fraudulent transfers are difficult to reverse. It also opens doors to further Aadhaar-linked identity theft if scammers get sensitive data on the fake pages.

Emotional distress follows as victims may face difficulty accessing funds, blocking accounts, or proving fraud to banks. SIM swap attacks may happen next, allowing fraudsters to intercept future OTPs, amplifying the damage.

Many victims report delays or refusal in refunds because banks treat these as authorized transactions if the victim shared OTPs or PINs—even unknowingly. This scam drains both money and peace of mind at a time when many Indians are already financially vulnerable.

What RBI and CERT-In Say

The Reserve Bank of India has repeatedly urged consumers not to share UPI PINs or OTPs with anyone, especially on platforms accessed through links received in SMS or WhatsApp.

CERT-In and I4C advise vigilance against phishing messages and recommend consumers verify bill dues only from official electricity board websites or authorized apps. The Indian government’s 1930 Cybercrime Helpline is available for victims seeking help.

RBI’s customer awareness campaigns emphasize using trusted apps, never clicking unknown links, and immediately reporting suspicious transactions.

How to Protect Yourself

1. Verify Official Sources: Always check electricity bills via your provider’s official app or website, not SMS links.
2. Ignore Urgent Payment SMS: Don’t click payment links sent via SMS claiming urgency; call your electricity board’s helpline first.
3. Never Share UPI PIN or OTP: Banks and electricity boards will never ask these via SMS or calls.
4. Use BHIM or Trusted UPI Apps: Pay bills via official apps installed from Google Play Store or Apple App Store only.
5. Check SMS Sender Details: Genuine electricity providers use specific, verified SMS IDs, not random phone numbers.
6. Keep Your Mobile and SIM Secure: Avoid sharing your SIM OTP or PIN; consider setting a SIM card lock via your telecom provider.
7. Enable UPI Transaction Alerts: Regularly monitor SMS transaction alerts to spot unauthorized payments early.

What to Do If You've Been Targeted

1. Immediately block your UPI app or bank account via mobile app or customer care.
2. Report the fraud to your bank and request a fraud transaction reversal.
3. File a complaint on cybercrime.gov.in with all details including the phishing SMS and payment info.
4. Call the national Cybercrime Helpline 1930 for advice and support.
5. Register a complaint with your local police cyber cell if large amounts are lost.
6. Inform your mobile operator to check for SIM swap or unauthorized SIM activity.
7. Change passwords and PINs for all banking and digital payment apps immediately.

Frequently Asked Questions

Q: Can I get my money back if I pay through a phishing SMS link?
A: It’s very difficult to recover money transferred via UPI phishing scams since transactions are instant and authorized using your OTP. However, immediately reporting to your bank and filing a cybercrime complaint improves chances.

Q: How do scammers get my phone number and billing info?
A: Many scammers collect numbers from data leaks, public directories, or hacking third-party databases. If you registered your mobile number with Aadhaar or online portals, it may be exposed too.

Q: How can I tell if an SMS link is fake or legitimate?
A: Legitimate electricity boards use official URLs without strange extensions or misspellings. Never trust messages asking for OTP, PIN, or Aadhaar details. Verify every bill via your electricity provider’s official app.

Stay safe from electricity bill payment phishing scams in 2026! If you get a suspicious SMS about your utility bills, don’t act on it without checking. Verify messages and links at BharatSecure.app before clicking or sharing any details. Protect your money and data — stay BharatSecure!