Bank KYC Update SMS Scam
An SMS says your bank KYC has expired and your account will be blocked today. The link or number steals your details and OTP.
A text arrives that says your bank account will be blocked today unless you update KYC now. It names a bank, includes a link and sometimes a number to call. Banks do ask customers for KYC updates from time to time, which is why this message works. Real updates are done at a branch or in the bank's official app, not on a link in a text message.
How the scam works
The scammer sends the same message to huge lists of numbers, assuming that some of the receivers hold an account with the bank named. Because the SMS says 'dear customer' with no name, it fits almost anyone. A short deadline, such as 'today' or 'within 24 hours', takes away your time to check with the branch or the bank's app.
The link opens a form that asks for your name, account number, date of birth, PAN number and then your net banking login or card details. A final page asks for an OTP to 'confirm the update'. If you call the number given, a person who sounds helpful asks you for the same details and may ask you to install a remote-help app.
The details give the scammer what they need to log in or to reset your passwords, and the OTP lets them approve transfers or add themselves as a payee. Your PAN and account data are stored and may be sold or reused for loan fraud or other scams, so the loss can go beyond the money taken from your account.
An example of what you may see
Example only: 'Dear customer, your bank account KYC has expired. Your account will be blocked today. Update immediately using the link below and enter your PAN, card number and the OTP you will receive. If you need help, call our KYC officer on the number given. Ignore this message and your account will be frozen at 6 pm.' The text comes from an ordinary mobile number and has a spelling error in the second line, and the link ends in an odd word.
This example is written for illustration. Real messages change their wording, names and links all the time.
Red flags
- The message has no name and says 'dear customer'.
- A link is used to update KYC instead of the bank's app or branch.
- PAN, card details and OTP are asked together.
- A same-day deadline and account block are threatened.
- A private mobile number is offered for 'KYC officer'.
- The sender ID looks odd or is an ordinary number.
What to do right now
- Do not tap the link or call the number.
- Open your bank's official app or visit the branch to check if KYC is pending.
- Never share an OTP, PIN or password in reply to a message.
- Delete the message and report it to your bank.
- Report the number on the Sanchar Saathi portal.
If you already paid or shared a code
- Call 1930 at once if money left your account, giving the time and amount.
- Call your bank on the number on your card or passbook and block cards and net banking.
- Change your passwords and PIN from a safe device.
- Report at https://cybercrime.gov.in with the message and screenshots.
National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.
Where this scam shows up
Read how it looks on each channel:
How Safeavio helps
Safeavio's scam check reviews the SMS you paste or share and gives a plain verdict with reasons such as urgency, fake authority and OTP asks. The link check examines the link for lookalike domains and shortened addresses before you open it. It does not read your messages on its own and cannot confirm your KYC status, so ask your bank.
Check it before you tap or pay
Safeavio Sentinel is a made-in-India Android app: paste a message or link, or scan a QR code, and get a plain verdict with the reasons. It helps you spot a scam; it does not promise to stop every one.
Download for AndroidWhat the app does
Google Play listing: coming soon. Today the signed APK is on safeavio.com/download. Android 7.0 or later.
Questions people ask
How can I check if my bank KYC is really pending?
Open your bank's official app, or visit the branch, or use the number printed on your card or passbook. Do not use a link or a phone number from a message. If KYC is needed, the bank can tell you safely.
Will my account be blocked in a day if I ignore the SMS?
A genuine bank follows a notice process through its own channels. A text with a same-day threat and a link is a known scam pattern. Check with your bank directly rather than reacting to the message.
Is it safe to share my PAN or Aadhaar number in a form?
Only inside your bank's own app or at the branch. Forms reached through a link in a message can store everything you type and reuse it. Do not enter ID numbers or OTPs in such forms.