KYC Update SMS Link Scam on WhatsApp

How it looks on WhatsApp, the red flags and what to do.

WhatsApp is private and fast, which scammers like: a "wrong number" chat can turn into a task, an investment tip or a payment request within minutes. KYC Update SMS Link Scam is one of the ways this shows up: A text says your KYC has expired and your account will be blocked today. The link opens a fake form that steals your card, OTP and PIN.

What kyc update sms link scam looks like on WhatsApp

• A PDF, APK or image that must be opened to "see the details".
• A link that pretends to be a wa.me, courier or bank page.
• A message from an unknown number, often with a stock photo of a smiling person.

The scammer buys or copies a bulk SMS service and sends the same text to lakhs of numbers. The message uses the name of a large bank because most people have an account with one of them. The sender name is often a random mobile number or a header that only resembles the real one. Nobody has checked whether you even bank there. They only need a few people to believe it.

Red flags to check on the WhatsApp message

• It threatens to block the account today.
• The link is shortened or the domain is not the bank's exact address.
• It asks for card number, CVV, PIN or OTP on a web form.
• The greeting is 'Dear customer' with no name or last digits.
• Someone asks for the six-digit code WhatsApp sent you by SMS.
• A new number says it is someone you know and asks for money; call the real person on the old number first.

What to do

1. Do not tap the link or reply to the message.
2. Open the bank's own app, which you installed from the official store, and look for a KYC notice there.
3. If you want to check, call the number printed on your debit card or passbook.
4. Open the chat, tap the contact name and choose Block and report.
5. If it was a "friend", call them on the number you already have and ask.
6. Turn on two-step verification in WhatsApp settings so a stolen SMS code is not enough.

Inside WhatsApp use Block and report; for numbers that call or text you, the Sanchar Saathi portal (Chakshu facility) also takes complaints.

If money or a code is already gone

1. Call 1930 at once and tell them the card or account details you entered.
2. Ask your bank, through the number on your card, to block the card and freeze net banking.
3. File a complaint at cybercrime.gov.in with screenshots of the text and the page.
4. Change your net banking password and UPI PIN from the official app.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Safeavio Sentinel lets you paste or share the text and gives a plain verdict with reasons such as urgency, a threat and a request for OTP or card details. The link check looks at the address for lookalike domains and shortened links before you open it. It works only on text and links you give it, so it cannot read your inbox on its own. It also cannot recover money already sent, so use it before you tap.

Full guide: KYC Update SMS Link Scam: how it works, signs and what to do. Other channels: SMS, email.

Questions