Fake Government/Bank Portals for PAN & Data Harvesting — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 27, 2026

Severity: CRITICAL | View Full Scam Details

Beware in 2026: Fake Government & Bank Portals Scam Stealing PAN and Personal Data in India

Scammers in India are creating fake government and bank websites to steal PAN, Aadhaar, and bank details, posing a critical threat to your financial safety.

What Is the Fake Government/Bank Portals for PAN & Data Harvesting?

This scam involves cybercriminals building counterfeit websites that look almost identical to official Indian government or bank portals where you might update or verify your PAN (Permanent Account Number) details. These fake sites aim to trick people into sharing sensitive information like PAN numbers, Aadhaar details, bank account numbers, and UPI IDs. Given the ubiquity of digital services linked to PAN and Aadhaar—such as tax filings, bank KYC, and loan applications—this scam particularly targets working professionals, taxpayers, and even students who need to verify their identity documents online.

The scope of this scam has grown rapidly across India in recent years. Fraudsters send messages via WhatsApp, SMS, or email claiming urgent updates or mandatory verification on PAN-linked services. These messages contain links directing users to these cloned portals. Victims believe they are on legitimate official sites because the fake portals often display government logos, RBI emblems, or bank branding. According to CERT-In (Indian Computer Emergency Response Team) and advisories from the RBI, such phishing attacks have intensified, especially during tax seasons and after major financial policy announcements.

How This Scam Works — Step by Step

1. Initial Contact via WhatsApp, SMS, or Email: You receive a message claiming urgent PAN-related updates or security verification required by the Income Tax Department, RBI, or your bank. The message creates a sense of urgency or warns about account suspension.

2. Clicking the Link: The message includes a URL link that looks official but actually leads to the fake government or bank portal. The website design closely mimics authentic sites with images of the Income Tax Department, RBI, or leading banks.

3. Entering Personal Details: On the fake portal, you are asked to enter your PAN number, Aadhaar details, date of birth, bank account number, and sometimes UPI ID or OTPs (One-Time Passwords) supposedly for verification.

4. Data Harvesting and Account Compromise: Once you submit the information, scammers capture it instantly. Using these details, they can commit identity theft, open fraudulent accounts, initiate unauthorized UPI transactions, or even bypass Aadhaar-based KYC.

5. Financial Loss and Data Misuse: After stealing your data, attackers can perform SIM swaps, request fraudulent loans, make UPI payments using your linked bank account, or sell your personal details on the dark web.

Real Warning Signs to Watch For

• Unexpected messages demanding urgent PAN or Aadhaar updates with threatening language.
• Links that don’t come from official domains like incometaxindia.gov.in or your bank’s verified web address.
• Poor website design, spelling errors, or unusual URLs (e.g., .incometax-update.com rather than official sites).
• Request for OTPs or passwords beyond normal login steps.
• Asking for bank account or UPI ID details on government portals (which typically do not require these for PAN updates).
• Messages from unknown or unofficial WhatsApp numbers or emails not ending with government or bank domains.
• No option to verify the request via official channels or customer care.

What Happens to Victims

Victims often face immediate financial loss when scammers use stolen details to transfer money via UPI or debit their bank accounts. Unlike credit cards, UPI transactions, once completed, are almost impossible to reverse unless caught early through bank grievance procedures. Many people also experience Aadhaar misuse leading to identity theft, such as unauthorized SIM swaps that allow fraudsters to intercept OTPs and reset passwords.

On the emotional side, victims suffer stress, anxiety, and loss of trust in digital platforms. The process to regain control can be slow, requiring multiple complaints to banks, filing FIRs, and monitoring credit reports. For salaried workers or small business owners, such scams can disrupt their financial standing in India’s increasingly digital economy.

What RBI and CERT-In Say

RBI and CERT-In have issued multiple warnings about phishing scams impersonating government and banking websites. RBI’s advisory emphasizes never clicking on suspicious links related to KYC or PAN updates sent via SMS, WhatsApp, or email. CERT-In strongly recommends verifying URLs directly by typing official site addresses rather than following message links.

Both regulators urge users to immediately report incidents using the national cybercrime helpline (1930) and to install official RBI or Income Tax Department apps verified on Google Play or Apple App Store. The Indian government’s I4C (Indian Cybercrime Coordination Centre) also collaborates with law enforcement agencies to combat such fraud through public awareness campaigns.

How to Protect Yourself

1. Always verify PAN or Aadhaar-related messages by visiting official portals directly—not through received links.
2. Check URLs carefully; official government sites end with .gov.in and official bank sites use secure HTTPS connections.
3. Never share OTPs, passwords, or sensitive data in response to messages or calls, no matter how urgent they sound.
4. Use two-factor authentication (2FA) on bank and government service apps wherever available.
5. Install security apps and keep your phone updated to detect phishing attempts and malware.
6. Regularly check your bank and UPI transaction history for any unauthorized activity.
7. Report suspicious messages immediately to the 1930 cybercrime helpline and inform your bank.

What to Do If You've Been Targeted

1. Stop all transactions immediately and change passwords for your banking, PAN, Aadhaar, and UPI apps.
2. Contact your bank’s customer support to freeze your accounts or block UPI IDs to prevent further loss.
3. File a complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in.
4. Call the cybercrime helpline at 1930 and report details of the scam and offender if known.
5. Inform Aadhaar authorities if you suspect identity misuse to initiate corrective actions.
6. Track your credit report to detect any new loans or accounts opened without your knowledge.

Frequently Asked Questions

Q: Can I update my PAN details through SMS or WhatsApp links?
No, the Income Tax Department does not ask for PAN updates via SMS or WhatsApp links. Always use the official income tax website or authorized government portals.

Q: What should I do if I receive a link asking for bank or UPI details on a government portal?
This is a red flag. Genuine government portals do not request bank account or UPI details for PAN verification. Do not enter any information and report the message to the cybercrime helpline.

Q: Is it possible to recover money lost through UPI scams linked to fake portals?
UPI transactions are generally irreversible. You must report the fraud to your bank immediately. Banks may investigate and, in some cases, help recover funds, but prevention is crucial.

Stay alert and protect your digital identity in 2026. Always verify any suspicious message or link before sharing your PAN, Aadhaar, or bank details. For quick verification, visit BharatSecure.app — India’s trusted platform to check messages and protect yourself from scams.