A KYC update fraud message threatens that your bank account, YONO app, PAN, wallet or electricity connection will be blocked "today" unless you click a link, install an app or call a number. Genuine organisations do not ask you to update KYC through unknown links or APK files, or to share OTPs and passwords. Do not click; open your bank's official app or website yourself, or visit the branch, to check if anything is really pending.
The RBI's own warning: fraudsters contact people through unsolicited calls, SMS or email, ask for personal details or to install unverified apps through links, and threaten that the account will be frozen, blocked or closed. Do not share KYC documents, card details, PINs, passwords or OTPs, and confirm any KYC request directly with your bank (RBI caution, 2 February 2024).
What KYC fraud messages look like (examples)
The messages below are examples written by us to show common patterns reported in India. Links are broken on purpose ([.]) so they cannot be opened. Real scam messages change wording often, so focus on the pattern, not the exact text.
| Example message (not real) | What the scammer wants | Red flags |
|---|---|---|
| "Dear Customer, your SBI YONO account will be blocked today. Update your Aadhaar/PAN now: download SBI_KYC.apk" | You install a fake banking app that steals your login, OTPs and SMS. | Threat of blocking, APK file, not from the Play Store. The PIB Fact Check unit flagged a message like this in January 2026 (AIR News). |
| "Your PAN card is not linked. Your account will be suspended in 24 hours. Update here: pan-kyc-update[.]online" | A fake login page that captures your net banking user ID, password and OTP. | Unknown domain, deadline, generic "Dear Customer". |
| "Download your instant e-PAN card: [link]" (email) | Your PAN, Aadhaar and bank details. | The PIB Fact Check unit called such e-PAN emails a phishing scam in August 2025; real income tax emails come from @incometax.gov.in (Business Standard). |
| "Dear Consumer, your electricity power will be disconnected tonight at 9.30 pm because your previous month bill was not updated. Contact our officer: 98XXXXXXXX" | You call, are asked to install a "bill payment" or screen-sharing app, and money is taken from your account. | Ordinary mobile number, "tonight" deadline. Electricity departments have publicly denied sending such messages (The Tribune, 2022). |
| "Your Paytm / PhonePe wallet KYC has expired. Call KYC helpline 98XXXXXXXX or your wallet will be closed." | A phone call where they ask for OTPs or tell you to install a remote-access app. | A personal mobile number as "helpline", pressure, request to call. |
| "Your mobile number will be deactivated in 2 hours due to incomplete KYC. Press 9 / call now." | To move you on to a fake "telecom" or "police" officer, sometimes leading to a digital arrest scam. | TRAI has said it does not call or message customers about disconnecting numbers (AIR News, April 2025). |
Why banks don't send KYC links like this
KYC (Know Your Customer) is real, and banks do have to update it from time to time. In 2025 the RBI asked banks to send customers notices before periodic KYC becomes due (Deccan Herald, June 2025). So getting a reminder is not, by itself, proof of a scam.
The difference is how you are asked to update. A genuine bank will ask you to use the branch, its official app or net banking, or another channel listed on its official website. It will not:
- send you an APK file or a link to a website that is not the bank's own domain
- ask for your OTP, UPI PIN, card CVV or net banking password
- give a personal mobile number as the "KYC helpline"
- threaten to block your account within a few hours
The RBI has been warning about exactly this trick since at least 2021 (Business Standard, September 2021).
Red flags checklist: how to spot a KYC fraud message in 10 seconds
- Urgency: "today", "within 24 hours", "tonight at 9.30".
- Threat: account blocked, card suspended, power cut, number deactivated.
- A link or file: especially short links, odd domains (
.xyz,.top,.online) or anything ending in.apk. - Sender: a normal 10-digit mobile number or an unknown WhatsApp account using a bank logo.
- Request for secrets: OTP, PIN, password, Aadhaar or PAN photos.
- Language: "Dear Customer", spelling mistakes, odd capital letters.
Even one of the first three is reason enough to stop and verify. Not sure about a link? Paste it into our free link checker, which flags look-alike bank, UPI and government domains, shorteners and APK links. Our guide on how to check if a link is fake shows how to read a web address yourself.
What to do if you get a KYC update message
- Don't click, don't call, don't reply.
- Check independently. Open your bank's app that you installed from the Play Store / App Store, or type the bank's website address yourself. If KYC is really due, it will show there, or the branch can confirm.
- Report the message on Chakshu at sancharsaathi.gov.in. It accepts suspected fraud calls, SMS and WhatsApp messages, including fake KYC requests.
- Forward bank phishing to the bank. For SBI-themed messages, PIB advised reporting to
report.phishing@sbi.co.in(per the AIR News report above). Other banks list their own reporting address on their official websites. - Delete the message after reporting, and block the sender on WhatsApp.
Already clicked, entered details or installed the app?
- Lost money? Call 1930 immediately and follow our first-hour UPI fraud guide.
- Call your bank's official helpline to block net banking, UPI and cards.
- Turn on flight mode if you installed an APK, then uninstall it. If it will not uninstall, it may have taken accessibility or device admin permission; see risky app permissions for how to remove them.
- Change passwords for net banking, email and UPI PIN from a different, safe device.
- Check your WhatsApp linked devices, because some of these apps also take over WhatsApp. See our WhatsApp security checklist.
Tip for families: scammers send these messages in bulk, especially around bill dates and festivals (see festive season scams). Agree on one simple family rule: "No KYC, bill or bank link is opened until we check it on the official app together."
Frequently asked questions
Do banks send KYC update links by SMS?
Banks may send reminders that your periodic KYC is due, but the RBI warns people not to share KYC documents, OTPs or passwords through links or unknown apps. Update KYC only at your branch or through your bank's official app or website, and confirm any request by contacting the bank yourself.
I clicked a KYC link but did not enter anything. Am I safe?
Usually just opening a link does little harm, but close the page and do not install anything it offers. If you entered details, downloaded an APK or shared an OTP, call your bank and 1930 immediately and change your passwords.
Where do I report a fake KYC SMS or WhatsApp?
Report it on Chakshu at sancharsaathi.gov.in, which covers fraud SMS, calls and WhatsApp messages. If you lost money, call 1930 or file a complaint at cybercrime.gov.in.
Is a message from a number with a bank name genuine?
Not necessarily. Scammers send messages from ordinary mobile numbers and WhatsApp accounts that use bank logos. Treat any message with a link and a threat of blocking as suspicious, whoever it seems to come from.
KYC update message aaya hai, kya karein?
Link par click mat kijiye aur koi app download mat kijiye. Apne bank ke official app, website ya branch se khud check kijiye, aur message ko Chakshu par report kijiye.
This guide is general information, not legal advice. If you have lost money to fraud, call 1930 immediately or report at cybercrime.gov.in.