Fake Bank Statement PDF Scam

An email or message sends a bank statement or credit card bill as a file or link. Opening it installs malware or opens a fake login page.

An email arrives with a subject like 'Your account statement for this month' or 'Credit card bill due', with an attachment or a download link. Because you expect statements from your bank, you open it. The file is not a statement. It may install a spying app on your phone or computer, or it leads to a page that asks you to log in so that it can steal your banking details.

How the scam works

The scammer sends the message to large lists of addresses, using the name and logo of a bank or card issuer. The subject line is plain and timely, and the message body is short, asking you to 'find attached your statement'. Some use a sender name that looks right in the inbox but whose address is odd when you open the details.

The attachment might be a document or archive that asks you to enable content or a download that prompts an install. Or a link opens a page that asks for a password to 'unlock the statement', which is your net banking password. On phones, the file may be an installation file that asks for permission to read messages and screens.

Once opened, malware records what you type, reads your OTP messages or gives the scammer access to the device. The password that you typed on the fake page is used to log in to the real account. The scammer may wait for a few days to see which banking apps you use, and then move money out when you are least likely to notice.

An example of what you may see

Example only: Subject: 'Your account statement for September'. Body: 'Dear customer, please find attached your account statement for this month. For security, the file is password protected. To unlock it, log in at the link given and enter your net banking password. If you do not view it within 24 hours, your e-statement service will be paused.' The sender address does not match your bank's website. The attachment is an archive file, not a plain document.

This example is written for illustration. Real messages change their wording, names and links all the time.

Red flags

• A statement arrives that you did not request.
• The sender address does not match your bank's website.
• You must log in or enable content to open the file.
• The file is an installation file or archive.
• A deadline or service pause is mentioned.
• The greeting is 'dear customer' and the layout is plain.

What to do right now

1. Do not open the attachment or tap the link.
2. Log in to your bank's official app to see your real statement.
3. Check the sender's address in the message details.
4. Delete the email and report it as phishing.
5. Run a phone or computer scan if you opened it by mistake.

If you already paid or shared a code

1. If you typed a password, change it at once from a safe device and call your bank on the number on your card.
2. Call 1930 if money moved and give the transaction details.
3. Uninstall any app or file that you installed from the message.
4. Report at https://cybercrime.gov.in with the email and its headers.

National Cyber Crime Helpline: 1930. Report online at cybercrime.gov.in. Do it fast: the sooner your bank is told, the better the chance that money can be held.

Where this scam shows up

Read how it looks on each channel:

How Safeavio helps

Safeavio's link check can review a download or login link before you open it for lookalike domains, shortened links and risky patterns, and the scam check can read the email text you paste. The phone scan can point out apps outside a store and apps that look like copies. It cannot scan email attachments, so do not open unexpected files.

• Phishing checks
• Phone health checks

Questions people ask

Other scams in this group

Also known as: fake account statement email, bank statement attachment fraud, e-statement link scam. More bank and card fraud