What it looks like
"Dear customer, your bank account will be suspended today. Update your PAN/KYC now: [short link]"
How the bank sms phishing scam works
- You get an SMS, WhatsApp or email that looks like your bank, with a scary deadline or a reward.
- The link opens a fake site that copies your bank's login page, or asks you to install an app (often an APK file).
- You enter your user ID, password, card details or PIN.
- The site then asks for the OTP, which the scammer uses to log in or approve a payment.
- A fake app may read your SMS and forward OTPs automatically.
- Money leaves your account within minutes.
Red flags
- Threat that your account will be blocked or closed today.
- A link to 'update KYC', PAN or reward points.
- Sent from a normal 10-digit mobile number instead of a bank sender ID.
- A shortened or misspelled link that is not your bank's real website.
- Asks you to install an app or APK file.
- Asks for your OTP, PIN, password or card CVV.
- Generic greeting like 'Dear customer'.
What to do
- Do not click. Open your bank app or type the bank's website yourself to check.
- Call your bank only on the number on its official website or the back of your card.
- If you clicked and entered details, call your bank at once to block cards and net banking, then change passwords.
- If you installed an app from the link, uninstall it and get the phone checked.
- In India, call 1930 at once and file a complaint at cybercrime.gov.in. Fast reporting gives the best chance to freeze the money.
- In India, report the fraud SMS on Sanchar Saathi (Chakshu). US: forward texts to 7726 and report at ReportFraud.ftc.gov. UK: forward texts to 7726.
Protect your family
Tell elders: the bank will never send a link to update KYC or ask for an OTP. If a message scares you, call me or the bank branch before doing anything.
Also known as: smishing, account blocked SMS, PAN update SMS scam
Questions people ask
I clicked a link in a fake bank SMS. What should I do?
If you only opened it, close it and do not enter anything. If you entered details or an OTP, call your bank to block your account and cards, change your passwords, and in India call 1930.
How do I know if a bank SMS is real?
Real bank SMS in India come from a named sender ID (often ending in -S or -T), not a 10-digit number, and never ask you to click a link to update KYC. When unsure, check inside your bank's own app.
Does RBI ask banks to block accounts for KYC by SMS link?
No. RBI has warned people not to click unknown links or share KYC documents, OTPs or passwords, and to confirm any KYC request directly with their bank.