Scam guide

KYC update scam: why your bank will never ask you to update KYC by SMS

Published 28 September 2026 · SafeHop guides

In short: a text says your bank account, card or wallet will be blocked unless you "update your KYC" through a link or a phone call. Banks do not do this. The link leads to a fake bank page that collects your login and OTP, and the caller talks you into sharing codes or installing a screen-sharing app.

What the message looks like

"Dear customer, your account will be blocked today. Update your KYC immediately: [link]"
"Dear SBI customer, your YONO account will be blocked…" or the same text with HDFC, ICICI or another bank's name. Scammers copy the names of the biggest banks; the bank itself did not send it.
"Your PAN card is not linked. Your netbanking will be deactivated. Click here to update."
"Your reward points will expire today. Redeem now: [link]", a close cousin that uses the same fake bank page.
In Hindi or Hinglish: "आपका खाता बंद हो जाएगा। केवाईसी अपडेट करें" / "KYC update karein, warna account band ho jayega".

How the scam works

The link opens a page dressed up as your bank's netbanking login. You type your customer ID and password, then an OTP "to verify". The scammers use them at the same moment on the real bank site to transfer money out. In the phone version, the "bank officer" asks for the OTP you just received, or asks you to install an app that lets them see your screen.

Warning signs

A threat and a deadline: blocked today, deactivated tonight, within 24 hours.
A link that isn't your bank's official address, for example the bank's name with extra words and an unusual ending, or a shortened link.
Any request for an OTP, PIN, CVV or password. No bank ever asks for these, by message or on a call.
A request to install an app such as a screen-sharing or "support" app.
A mobile number as the sender instead of the bank's usual sender name.

Banks and India's banking regulator repeatedly remind customers that they never ask for KYC updates, OTPs or passwords through links or calls. If your KYC really needs updating, your bank will ask you to do it in its official app or at a branch.

What to do

Don't click and don't call back. Open your bank's official app, or call the number printed on your card.
Paste the message into the SafeHop message checker to see the warning signs.
If you shared an OTP or password: call your bank immediately to freeze your account, change your netbanking password, and report it at 1930 or cybercrime.gov.in. Fast reporting gives the best chance of stopping the transfer.
You can also report fraud calls and messages on the government's Sanchar Saathi portal (Chakshu).

Got a message like this? Paste it into SafeHop's free checker. It reads the wording and every link, and tells you if it looks like a scam, without opening anything. Your message never leaves your browser.

Check a message Get the free extension

More guides

This guide is general safety information, not legal or financial advice. Companies and authorities are named only to show who scammers pretend to be; SafeHop is not affiliated with any of them.