The KYC update scam: the link that empties your account
Real banks never update KYC through a random link
A KYC update scam is a fake message or call warning that your bank account, SIM or wallet will be blocked unless you update your KYC right now, usually through a link or an app they send you. The panic and the deadline are the whole trick. Real banks never ask you to update KYC through a random link or by installing an app from a message. (KYC, or Know Your Customer, is the identity check banks are required to do.)
How the trick works. You get an SMS or WhatsApp: “Your account will be blocked today. Update your KYC immediately.” It links to a page that looks like your bank, or asks you to install an app. Enter your details or install it, and the scammer either captures your login and OTP or takes remote control of your phone, then drains the account.
Why it works. Fear and a deadline. Nobody wants their account frozen, so people click before they think. That rushed click is exactly what the scam needs.
The red flags. A deadline (“today”, “within 2 hours”), a link or an app to install, and any request for your OTP, PIN, card number or CVV. Banks ask for none of these. See the one rule that also stops UPI fraud: your UPI PIN never receives money.
The safe move. Do not use the link. Open your bank’s own app or call the number on your card, and ask if KYC is really due. Almost always, it is not.
Want the full picture? See how scammers target UPI users and how to report a fraud fast.
This is general education, not financial advice. Scam tactics and bank processes change, so confirm anything KYC-related with your bank directly, and report fraud on 1930 and cybercrime.gov.in.
-
Do not click or install anything
Never tap a link in a KYC message, and never install an app someone sends you to 'complete KYC'. That app or link is how they take control of your phone or account.
-
Check with your bank directly
Open your bank's official app, or call the number printed on your debit card or the bank's website. Ask if any KYC update is actually due. Usually it is not.
-
Never share OTP, PIN or card details
No bank employee ever needs your OTP, UPI PIN, card number or CVV. Anyone asking for them, for KYC or anything else, is a scammer.
-
Report it
If you clicked, installed or shared anything, act fast. Call 1930 and file on cybercrime.gov.in. The sooner you report, the better the chance of stopping a loss.
Questions people ask
What is a KYC update scam?
A fake message, call or email warning that your bank account, SIM or wallet will be blocked unless you update your KYC right away, usually through a link or an app they send. Clicking or sharing details lets them steal your money or control your phone.
Do banks ask you to update KYC by SMS link?
No. Real banks do not send a link to update KYC, and they do not ask you to install an app from a message. KYC updates happen through the bank's official app, website or branch. A link with a deadline is a scam sign.
What are the warning signs?
Urgency and a deadline (account blocked today), a link or app to install, and a request for your OTP, PIN, card number or personal details. Any of these means stop.
What should I do if I clicked the link or shared an OTP?
Act immediately. Call your bank to block the account or card, then call 1930 and file on cybercrime.gov.in. Reporting fast gives the best chance to limit the loss.
How do I update KYC safely?
Only through your bank's official app, website or branch, started by you, never from a link someone sent. If unsure whether KYC is due, call the number on your card or the bank's official site.
Source: RBI customer awareness notices and the National Cyber Crime Reporting Portal (cybercrime.gov.in). Confirm current guidance there.