₹ Dhuddu · Track your money on the go

Blog · Fintech · · 4 min read

Fake KYC update messages: how to spot the scam and what to do

Got an 'account blocked, update KYC now' SMS? Learn the red flags of fake KYC scams, how to verify safely, and whom to call (1930) if you already clicked.

By Dhuddu Team

Your phone buzzes. "Dear customer, your bank account will be blocked today. Update KYC now: tap the link." Your heart skips, because a blocked account before rent day is a nightmare. That moment of panic is exactly what the sender is counting on.

Fake KYC messages are one of the most common frauds in India, and they keep changing shape. Here is how they work, how to spot them, and what to do if you have already clicked.

What a fake KYC scam looks like

KYC (Know Your Customer) is a real process. Banks, wallets and brokers do ask you to keep your documents current. Scammers borrow that credibility.

Typical versions:

  • The "account will be blocked" SMS or WhatsApp. A link to a look-alike bank page asks for your net banking login, card number or OTP.
  • The "electricity KYC" message. It says your power connection will be cut tonight unless you update details, and pushes you to install an APK file. Reports from earlier campaigns said such files can give fraudsters control over a phone, and the Department of Telecommunications acted against mobile connections linked to it.
  • The helpful "executive" call. Someone claiming to be from your bank asks you to read out an OTP "to verify your identity", or to install a screen-sharing app.
  • The UPI twist. You are asked to "approve" a request or scan a QR code to complete KYC. Entering your UPI PIN only ever sends money out, never brings it in.

The red flags

  1. Urgency. "Today", "within 2 hours", "account closed". Real KYC reminders give weeks, not hours.
  2. A link or file in an SMS or WhatsApp message. Banks do not require you to update KYC by tapping a random link or installing an app from a message.
  3. Requests for OTP, PIN, CVV or password. No genuine bank employee needs these. Ever.
  4. Odd sender details. A personal mobile number, spelling mistakes, or a web address that is not your bank's official one.
  5. Pressure to stay on the call. Scammers do not want you to hang up and think.

Do this instead

  • Do not tap. Do not call back the number in the message.
  • Open your bank's official app or type the website address yourself. If KYC is really due, the app will show it.
  • Visit the branch or call the number printed on your card or passbook if you are unsure.
  • Never install an app from a link or a forwarded file. Android apps should come from the official store only.
  • Report the message. The government's Sanchar Saathi portal has a facility called Chakshu for reporting suspected fraud calls, SMS and WhatsApp messages. Your report helps get the sender blocked for everyone.

If you already clicked or shared details

Speed matters more than embarrassment.

  1. Call your bank immediately and ask them to block your cards, net banking and UPI.
  2. Call the national cybercrime helpline 1930 and file a complaint at cybercrime.gov.in. Early reports give the best chance of stopping the money.
  3. Change passwords and your UPI PIN from a safe device.
  4. If you installed an unknown app, uninstall it and consider a factory reset if the phone behaves oddly.
  5. Keep evidence: screenshots, the sender number, the link, transaction IDs.

A quick example

Meera, a 29-year-old designer in Pune, gets a message at 9 pm: "KYC expired, account frozen in 2 hours." She almost taps the link, then notices the web address is not her bank's. She opens her bank app instead, finds nothing pending, and reports the message on Chakshu. Total time lost: three minutes. Total money lost: zero.

Practical takeaway

  • Treat every KYC message with a link as fake until proven otherwise.
  • Verify only through the official app, website, or the number on your card.
  • Never share OTP, PIN or CVV, and never install apps from messages.
  • Remember 1930 and cybercrime.gov.in before you need them.
  • Check your accounts weekly so an unfamiliar debit does not stay hidden.

This is general information, not financial advice.

Sources

How Dhuddu can help

Scams often show up first as a debit you did not recognise. Dhuddu is a free expense tracker that can read your Indian bank alerts and list every transaction in one place, so an odd charge stands out quickly. You can also get it on Google Play.

More from the blog