Fake KYC SMS Banking Scam — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 25, 2026

Severity: CRITICAL | View Full Scam Details

Beware the Fake KYC SMS Banking Scam in India 2026: How to Protect Your UPI and WhatsApp Accounts

Critical alert for all digital banking users in India in 2026: The Fake KYC SMS Banking Scam is on the rise, targeting millions through fake SMS messages impersonating banks, putting your UPI and Aadhaar-linked accounts at serious risk.

What Is the Fake KYC SMS Banking Scam?

The Fake KYC SMS Banking Scam is a dangerous and fast-growing cybercrime in India where fraudsters send deceptive SMS messages pretending to be your bank, asking you to complete or update your KYC (Know Your Customer) details urgently. These messages appear highly convincing, often using official bank logos, names like SBI, HDFC, or ICICI, and legal-sounding language to push recipients into action.

Scammers mainly target anyone who uses digital banking platforms, especially those new to online banking or less aware of banking security protocols. Given that over 80 crore Indians now use UPI for instant payments and transfers, fraudsters exploit this massive user base, sending millions of phishing SMSes across cities and rural areas alike.

The scam has spread rapidly, with CERT-In (Indian Computer Emergency Response Team) and I4C (Indian Cyber Crime Coordination Centre) issuing alerts about how criminals are harvesting contact lists from previous data breaches or buying personal details from the dark web to personalize their attacks. The Reserve Bank of India (RBI) has also warned banks and users to stay alert against such fraudulent communication.

How This Scam Works — Step by Step

1. Scammer Harvests Contacts: Fraudsters either steal phone numbers from data leaks or buy databases containing mobile numbers linked to bank accounts.

2. Fake SMS Sent: The victim receives an SMS claiming to be from their bank, such as SBI or HDFC, quoting urgent messages like “Your KYC verification is pending. Complete now to avoid account suspension.”

3. Link or Number Included: The SMS includes a link or phone number to “verify” or “update” KYC details. This link leads to a fake website perfectly mimicking the bank’s official portal or a WhatsApp number linked to scammers pretending to be bank officials.

4. Victim Clicks or Responds: The victim clicks the link or replies on WhatsApp, unknowingly sharing sensitive information like Aadhaar number, PAN card details, UPI PIN, or OTPs.

5. Data and Money Theft: With OTPs or PINs, fraudsters quickly authorize UPI transfers or SIM swaps, stealing funds directly or draining bank accounts.

6. Covering Tracks: Scammers may delete messages or boot victims from apps remotely, complicating recovery.

The main goal is to steal data to access UPI wallets linked to Aadhaar or bank accounts, exploiting India’s rapid digital payments growth.

Real Warning Signs to Watch For

• SMS or WhatsApp messages demanding urgent KYC updates, threatening account suspension.
• Links that don’t start with your bank’s official domain (look closely at URLs).
• Requests for sensitive data like OTPs, PINs, Aadhaar number, or passwords via SMS or WhatsApp.
• Poor grammar or spelling mistakes in what appears to be an official message.
• Messages coming from unknown numbers that don’t match official bank contact info.
• Unexpected calls or WhatsApp texts claiming to be “bank officials” asking for personal details.
• Offers to “help” complete KYC on WhatsApp or via suspicious links.

What Happens to Victims

Victims often lose thousands or even lakhs of rupees in minutes as scammers use stolen OTPs and UPI PINs to transfer money instantly. Banks find it challenging to reverse these transactions immediately because they appear authorized via the victim’s credentials. Besides financial loss, victims face emotional stress and helplessness disrupting their trust in digital payment systems.

In some cases, SIM swap fraud occurs—scammers convince telecom operators to switch the victim’s mobile number to a new SIM, gaining full control over SMS and calls for OTP verification. This lets criminals bypass two-factor authentication easily. Personal data like Aadhaar and PAN also can be misused for identity theft, opening loans or bank accounts fraudulently in the victim’s name.

What RBI and CERT-In Say

Both RBI and CERT-In have repeatedly warned users against sharing confidential banking details via SMS or WhatsApp. RBI’s guidelines emphasize that banks will never ask for OTPs, passwords, or PINs over calls or messages. The 1930 Cybercrime Helpline, supported by CERT-In and I4C, is operational 24x7 to report frauds like these.

RBI instructs all banks to educate customers about phishing and fake KYC messages and implement strong authentication processes. CERT-In’s advisory outlines steps to verify communication authenticity before responding or clicking any link. Users are urged to report suspicious texts immediately and not trust unsolicited banking messages.

How to Protect Yourself

1. Never click on suspects links: Always visit your bank’s official app or website to check any KYC notices.
2. Ignore urgent, pushy requests: Banks do not threaten suspension via SMS or WhatsApp.
3. Do not share OTPs or UPI PINs: Keep these confidential always.
4. Verify sender’s number: Call your bank’s official helpline (found on RBI or bank website) if unsure.
5. Use official banking apps: Avoid conducting transactions via links sent over SMS or WhatsApp.
6. Enable app-level passcodes and biometric locks: Add extra security for digital wallets.
7. Check for SIM card security: Set up a PIN with your telecom provider and report immediately if SIM is lost or stolen.

What to Do If You’ve Been Targeted

• Immediately call your bank’s customer care to block UPI and debit card transactions.
• File a complaint with the 1930 Cybercrime Helpline and on cybercrime.gov.in under “Financial Fraud.”
• Inform your mobile operator to block or deactivate your SIM if you suspect a SIM swap.
• Change all bank app passwords and UPI PINs after securing your device.
• Keep evidence like SMSes, WhatsApp chats, or screenshots ready for police reports.
• Visit the nearest cybercrime police station if large amounts were stolen.
• Monitor your account regularly for unauthorized activity.

Frequently Asked Questions

Q: Can my bank really suspend my account via SMS for incomplete KYC?
No. Official banks do not suspend accounts via SMS without prior official communication, usually through letters or emails, and never demand sensitive info via SMS.

Q: What should I do if I accidentally clicked a fake KYC link?
Immediately disconnect from the internet, do not enter any details, and contact your bank and cybercrime helpline to secure your accounts.

Q: How does sim swapping help scammers in this scam?
SIM swapping allows criminals to intercept OTPs and calls, letting them bypass security measures of your bank or UPI app, making it easier to steal money quickly.

Stay safe in 2026’s digital world! If you receive suspicious SMS or WhatsApp messages about KYC or banking, do not panic or respond immediately. Verify all such messages at BharatSecure.app before taking any action. Your vigilance is the best shield against cybercrime.